feat(desktop): download updates in the background

[tonyfettes]

What

The desktop self-update flow now downloads installable releases by itself; restarting into the staged bundle stays the user's click.

• A check that finds an installable release starts update.download immediately (startup and manual checks alike); the new UpdateReady state parks the staged bundle behind a "Restart to update" button. The busy-confirmation modal moved from before-download to before-apply, where the interruption actually happens.
• Download failures always toast and restore the retry offer; apply_update still runs only on the restart click (swapping the bundle under a running CEF app risks AMFI kills on lazy loads).

Channel-race hardening

The update channel derives from the API provider, which loads asynchronously from host settings; the races between that load, channel switches, and the host's single-download pump are closed:

• The startup check waits for the first authoritative host-settings load instead of riding BridgeReady with initial_model's default production channel, and re-fires whenever the channel moves (provider switch, remote settings edit, failed-save restore).
• update.check replies carry the channel they asked; a reply landing after the provider moved is void, and the auto-download binds to the checked channel.
• The host pump stamps channel on update.download_progress / update.downloaded / update.download_failed; the frontend's DownloadingUpdate carries its channel and voids mismatched events, so a leftover staging download can never complete as a production one.
• A channel move during a download leaves the flow draining: the state stays put (keeping Check disabled and the busy pump unpoked) until its terminal event, which quietly discards the result and checks the channel now in force. A staged release is forgotten and re-checked immediately on a move (the pump is idle after staging) but survives a same-channel settings reload.
• Manual checks are held until host_settings_loaded() — before that the channel is only the default, and an early check could start a wrong-channel download whose reconciliation would swallow the real startup check.

Tests

• moon test --target js desktop/frontend: 313 passed (new coverage: draining lifecycle, cross-channel event voiding, checks gated on settings, staged version taken from the host, channel-bound replies)
• moon test --target native desktop/internal/host: 19 passed
• The live download → restart → relaunch path on a real signed bundle remains to be verified by hand.

🤖 Generated with Claude Code