fix(updater): require confirmation before installing downloaded updates

[kev1n77]

Summary

• Separate application updates into background download, user confirmation, and installation with restart.
• Prompt after downloading and warn that restarting will interrupt active sessions on the current device.
• Preserve downloaded updates when users choose “Later,” and direct them to About → Install and restart.
• Restore pending updates across application restarts and reverify cached package integrity and signatures before installation.
• Update English, Simplified Chinese, Traditional Chinese, documentation, and generated capability artifacts.

Type and Areas

Type: Bug fix / UI/UX

Areas: Desktop/Tauri, Web UI, update caching and signature verification, capability registry, internationalization, documentation, and tests.

Motivation / Impact

Previously, accepting an update could trigger installation and application exit immediately after downloading, interrupting tasks that users continued or started during the download.

This change separates permission to download from permission to install and restart. Users can continue working during the download and explicitly choose when to install, without introducing task-completion scheduling or automatic restart logic.

Verification

Passed after rebasing:

pnpm run capabilities:check

pnpm --dir src/web-ui exec vitest run src/infrastructure/update/updateInstallStore.test.ts src/infrastructure/update/installUpdateWithProgress.test.ts src/infrastructure/update/UpdateInstallProgressModal.test.tsx src/infrastructure/api/service-api/SystemAPI.test.ts src/infrastructure/api/generated/remoteSurface.test.ts

git diff --cached --check

All 27 tests across five files passed, covering confirmation, deferred installation, pending-update restoration, failure retries, duplicate-operation prevention, and controller-local routing.

Additional checks passed before rebasing:

cargo check -p openbitfun-desktop
cargo build -p openbitfun-desktop
cargo test -p openbitfun-product-domains --no-default-features remote_surface
pnpm run check:web
pnpm run i18n:audit
pnpm --dir src/web-ui exec tsc --noEmit

The remote-surface contract suite passed all 19 tests.

Verification limitations:

• cargo test -p openbitfun-desktop --lib api::update_api::tests compiled successfully, but the test executable encountered the known Windows/Tauri loader issue STATUS_ENTRYPOINT_NOT_FOUND before any tests ran.
• pnpm run check:core-boundaries was blocked by an existing broken HarmonyOS link at entry/oh_modules/libbitfun_crypto.so.
• No real application update or restart was triggered. Remote Workspace, Remote Control, Peer Device Mode, and Detached Dispatch were not exercised end to end.

Reviewer Notes

• Confirmation is always requested after downloading; the flow does not depend on active-session detection.
• New update commands are declared ControllerLocal: installation targets the current desktop device and is not forwarded to a peer.
• The legacy install_update command remains available for compatibility; the updated UI uses the staged commands.
• Installing after reopening the application requires network access to restore installer metadata, but does not download the package again. Failures preserve the cache for retry.
• All six rebase conflicts involved generated artifacts. They were regenerated from the merged sources, preserving both upstream indentation-detection settings and the new update capabilities.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.