feat(updater): add signed in-app updates

[Mathious6]

What changed

• add explicit check and install controls to the bottom bar
• sign and verify Tauri updater artifacts from GitHub Releases
• assemble releases serially as drafts and publish only after validating all platforms
• bump the updater bootstrap version to 0.3.0

Verification

• bun run check
• bun run build
• cargo fmt --all --manifest-path src-tauri/Cargo.toml -- --check
• cargo clippy --locked --all-targets --manifest-path src-tauri/Cargo.toml -- -D warnings
• cargo test --locked --lib --manifest-path src-tauri/Cargo.toml
• local macOS arm64 updater bundle build and minisign verification
• tampered updater artifact rejection

Release note

0.3.0 is the bootstrap installer. A separate version-only 0.3.1 release is required to prove the production update path.