Ship host-owned updates and member-scoped routing

[gitcommit90]

Summary

• move all app updates onto the machine hosting 1Helm, with signed native macOS updates and digest-verified atomic Linux updates
• make current-event questions research first and attach real sourced web images
• give every member private/shareable provider accounts, personal model selection, revocable keys, usage identity, and a dedicated host loopback port
• keep terminal sessions alive and silently reconnect the browser transport after backgrounding or brief network loss
• release 1Helm 0.0.4

Verification

• npm run typecheck
• npm run build
• npm run test:onboarding-browser (20 passed)
• npm run test:brief-browser (29 passed)
• npm run test:production-browser against a disposable production-data copy (18 passed)
• npm test (116 native-world assertions + 56 Node tests)
• live Bing news/image fetch for the West Hollywood Sunset Boulevard incident
• git diff --check
• Apple signing/notary preflight on macstudiojoseph; independent host preflight on macair