feat(updates): self-update the packaged app from GitHub releases #1120

Motivation

The packaged app is manually updated by downloading dmg files; today's extension capabilities shipped to main but the released app (v0.1.0) predates them, which broke an extension install with an accurate-but-stale 'unknown capability' error. The release pipeline already produces electron-updater's full feed (latest-mac.yml + blockmaps on every release) — the app just never reads it.

Intended behavior

• Packaged app checks GitHub (public repo, anonymous) for a newer stable release on launch (rate-limited) and on demand via the app menu
• Downloads in background (blockmap differential where possible); never force-restarts; 'Restart to update' applies only through the existing fix(lifecycle): preserve services when Quit is cancelled #945 graceful-quit choreography and relaunches
• Unsigned dev builds no-op cleanly; signature mismatches surface actionable copy
• electron-builder.yml gains the github publish provider so packaged apps embed app-update.yml (the actual missing wire)
• Ship through it as v0.1.1 (patch)

Plan: docs/plans_and_ideas/2026-09-21-auto-update-plan.md (verified facts, staged implementation, test-first UpdateService)

Acceptance criteria

• app-update.yml embedded in packaged builds; unsigned local builds still succeed
• UpdateService unit tests: state machine, no-auto-restart invariant, dev no-op, error mapping
• restartToUpdate routes through the before-quit veto path, not around it
• Menu 'Check for Updates…' + status/notification surface
• v0.1.1 released via workflow with latest-mac.yml + blockmaps verified; feed shows the new version
• Claude-agent consultations recorded (policy + pitfalls + pre-merge review)