fix(updater): recover rate-limited checks and install macOS updates

[YinBuLiao]

Result / 用户结果

Fixes macOS update checks that failed with HTTP 403, and adds in-app installation of the downloaded macOS application in the same PR.

• GitHub REST 403/429 falls back to the official latest-release redirect and its SHA256SUMS asset. If verified package metadata is unavailable, version discovery still works and manual download remains available.
• ARM64 and Intel Macs select their matching DMG. After download verification, Restart and install saves the workspace, replaces the .app, relaunches it and restores the workspace. Install on next launch uses the same transaction. Immediate launch failure restores the original app; cancellation, a bad package or another running copy leaves the original untouched.

Design / 设计边界

• Exact package selection belongs to update_check::assets; streaming, checksums and transaction/restore authority remain in update_download. The macOS platform adapter owns native process, signature, mount and filesystem operations.
• The helper runs outside the app being replaced. It requires explicit commit, waits for the exact originating process, uses an installation-wide lock, verifies SHA-256 / DMG trailer / bundle identity / version / architecture / code signature, then atomically exchanges same-volume app directories. Developer ID installations also require the same signing team.
• Reuses the existing schema-1 handoff and workspace restore format. No new dependency, elevated installer or embedded credential. Normal builds still require a newer version. The existing debug-only, loopback test source is used solely for acceptance.
• Requires an official-identity packaged app in a writable location. Disk-image launches, App Translocation and developer binaries cannot self-install. The complete original app is retained as a hidden sibling backup; longer startup health checks and backup retention policy are not introduced.
• Windows retains its existing installer helper; Linux retains manual installation. No version bump, release/tag changes or published assets.
• Rationale: discovery fallback, macOS handoff.

Evidence / 验证依据

Locally verified on macOS ARM64:

• cargo test --offline --locked -p nebula --bin pebrel --features gpui-test-support,gpui_platform/runtime_shaders update_ -- --test-threads=1: 52 passed, 2 explicit acceptance tests ignored by default.
• Explicit native acceptance test with a freshly built product executable: real signed Mach-O fixture apps and HFS+ DMGs; success/relaunch, immediate-failure rollback, cancellation, invalid digest and another running instance all passed.
• Explicit live GitHub test passed. The unauthenticated REST endpoint was observed returning HTTP 403; the official fallback found v1.9.0. The normal current-v1.9.0 build correctly reports no upgrade.
• Real packaged GPUI window rehearsal, isolated settings and debug loopback source: verified DMG download → Restart and install → application replacement → reopened terminal window; transaction result was successful and restored.json was written. Same-version reinstall is a test-only facility, not shipped update behavior. The update dialog retains its compact horizontal footer. The Chinese ready hint is shortened to avoid an orphan full stop, and English action labels are shortened to fit. Exhaustive hover/keyboard/DPI and native Korean review are not claimed.
• Downloaded the official v1.9.0 ARM64 DMG and confirmed formal bundle ID, matching bundle/executable version and strict signature verification.
• Standalone i18n contract: 20 passed, informational benchmark ignored; includes zero-allocation lookup.
• Fresh GPUI product build, cargo fmt --all -- --check, git diff --check, and architecture check against base 0110c7c passed. No budgets changed.
• The branding wiring assertion now follows the native asset selector; its previous literal Windows-only call pattern falsely rejected the shared adapter. Current/legacy Windows names, the shared selector connection, exact-name rejection and the macOS route remain checked. All 53 architecture guardrail tests and the branding/image tests pass locally.
• Local runtime acceptance does not cover Intel macOS, Windows/Linux execution, Developer ID/notarization or privileged installation. Platform CI is separate; this PR does not claim a release is deployed.

Required Review / 必须确认

• Followed CONTRIBUTING.md, architecture and engineering contracts.
• Responsibilities follow capability ownership; no duplicated transaction or session authority.
• Architecture validation passes against the actual PR base without budget increases.
• Success and failure regressions are covered; platform limitations are stated.
• New UI messages use typed i18n IDs, English/Chinese/Korean entries and existing fallback contracts.
• Governance changes: not applicable.