Add secure in-app updates

[Charlie284]

Summary

• Add Sparkle 2.9.4 with automatic and manual update checks from the app menu, menu-bar menu, and About screen
• Verify downloaded update archives with Startle's Ed25519 public key and enable Sparkle's sandboxed installer services
• Split release builds from the protected signing and publishing job
• Pin third-party workflow actions and verify the official Sparkle signing-tool archive by SHA-256 before it can access the release key
• Document updater behavior, privacy impact, and release verification requirements

Testing

• swift test -c release --disable-sandbox -Xswiftc -warnings-as-errors — 37 passed
• Xcode test action with warnings as errors — 37 passed
• Universal arm64/x86_64 Release build
• Scripts/verify-unsigned-build.sh against the final Release bundle
• Exact CI signing-path rehearsal with Sparkle signature verification
• Strict Swift formatting, plist validation, shell syntax checks, workflow YAML parsing, and git diff --check