Publish signed fork updates automatically after CI

[EricRasputin]

What changed

MonoCode Fork currently requires a manual rebuild to update. Successful CI runs on main now build signed Apple Silicon and Intel packages and publish a complete GitHub release/update feed. Check for Updates shows the fork name, asks before installing and restarting, and directs unconfigured fork builds to fork releases.

Why

Give the fork a repeatable in-app update path. Fork versions use 0.2.<CI run number> independently of upstream, with immutable package URLs, both architectures required before publication, and protection against older runs replacing newer releases. The inherited upstream publisher is restricted to the upstream repository. The updater signing secret is configured separately in GitHub; only its public key is committed.

Existing 0.1.x installations need one initial replacement. macOS packages retain ad-hoc code signing; Apple notarization requires separate credentials. The runbook documents installation, signing, retries, and recovery.

UI

No layout changes. Update dialogs use the app's name and explicitly mention restarting.

Validation

• npm run check:web: 2,324 frontend tests and 5 release tests passed; TypeScript passed.
• npm run build: passed (existing bundle-size warnings).
• cargo fmt --check, actionlint, and git diff --check: passed.
• Native macOS npm run build:fork -- --ci: passed. Verified bundle identity/version, embedded updater endpoint/public key, macOS code signature, and updater signature; a tampered archive was rejected.
• PR CI passed on macOS, Linux, and Windows, including Rust formatting, clippy, compilation, and tests.

Checklist

• Full npm run check equivalent passes in CI
• This PR is focused on fork releases and updates
• I did not mix unrelated changes