Windows in-app updater: download, staged install, relaunch

[coneilen]

Windows in-app updater: download, staged install, relaunch

Implements the in-app Windows updater (download → checksum verify → extract →
staged install → Relaunch Now/Later), matching macOS behaviour, and unblocks
the Install progress / Relaunch prompt rows in investigation/ui-parity-matrix.md
plus advances Available update alert.

What changed

• graphcode-windows/src/WindowsUpdateInstall.zig (new): download over HTTPS
  with progress reporting, SHA-256 checksum verification (reusing the release
  pipeline's checksum-sidecar format), ZIP extraction, and invocation of the
  existing GraphCode-Setup.ps1 -Command Upgrade — reusing the packaging
  layer's shared verification/rollback logic rather than a second copy.
• graphcode-windows/src/UpdateInstallDialog.zig (new): native in-window
  progress indicator (download %, verifying, extracting, installing) and the
  post-install Relaunch Now / Later prompt with session-continuity copy, plus
  a failure state.
• graphcode-windows/src/UpdateOfferDialog.zig: Install is now conditionally
  enabled (buttonsFor(installable)) based on whether the real feed check
  resolved a Windows asset URL, instead of being permanently disabled with a
  "not implemented" label.
• graphcode-windows/src/App.zig: wires the offer dialog's new .install
  action to runInstall()/relaunchAfterUpdate(); structural change to a
  shared file (new fields + two new methods on App), flagged separately to
  the fleet coordinator.
• graphcode-windows/src/UpdateInstallLiveRunner.zig (new): a zig run-only
  driver (no test blocks, so outside the anti-drift guard) that exercises
  the real install() path against real HTTPS infrastructure for live
  evidence — not shipped in the app binary.
• Tools/windows/Tests/WindowsUpdateInstall.Live.Tests.ps1 (new): standalone
  live-evidence script (network-using, intentionally not part of the
  hermetic WindowsShell.Tests.ps1 suite) that runs the real feed check and
  a real download+checksum-verify against a real GitHub release asset.
• investigation/ui-parity-matrix.md: Available update alert and
  Install progress updated to Partial with honest evidence notes;
  Relaunch prompt moves from Blocked to Partial.

Honest evidence limits (please read before merging)

No Windows release asset currently exists on scgopi/GraphCode (re-confirmed
live at test time, not assumed) — only macOS DMGs are published. That means
the full download→extract→upgrade→relaunch happy path against a real
Windows ZIP cannot be exercised live in this PR, and neither can whether a
genuinely running graphcode-windows.exe can rename its own install
directory during self-update, or whether zmx sessions survive an
Upgrade-triggered daemon restart specifically. These are left honestly
Partial in the ledger rather than asserted Validated. What is live-proven:
a real HTTPS download of a real multi-megabyte GitHub asset streams genuine
progress and its SHA-256 is verified against the asset's real published
digest before extraction is attempted, and a deliberately wrong digest is
rejected with ChecksumMismatch strictly before extraction — proving the
checksum gate is not vacuous.

RED: zig run src\UpdateInstallLiveRunner.zig -- download-checksum https://github.com/scgopi/GraphCode/releases/download/v0.1.74/graphcode-macos-arm64.dmg 0000000000000000000000000000000000000000000000000000000000000000 -> result=error name=ChecksumMismatch, reached only as far as phase=verifying (never extracting), proving the check inspects real bytes
GREEN: pwsh Tools\windows\Tests\WindowsUpdateInstall.Live.Tests.ps1 -ZigExecutable $env:GRAPHCODE_ZIG0152 -> Windows update install live gate: PASS (real feed-check asset_url=none, real 21271139-byte download with 104 progress reports verified against the asset's real published sha256, wrong-digest rejection)
REGRESSION: pwsh Tools\windows\Tests\WindowsShell.Tests.ps1 -ZigExecutable $env:GRAPHCODE_ZIG0152 -> All 273 tests passed, Windows shell scaffold contract: PASS (42 source files executed)