feat(update): one-click desktop self-update (AppImage, .deb, Windows)

Same change as Guará: update_apply used to flatly refuse to run for
the GUI binary and point the user to a manual download instead. Since
the desktop app already elevates to root before showing its window,
the process applying the update already has everything it needs — no
second authentication round is required.

- New sabia_core::update::apply_desktop[_with_progress], alongside the
  existing CLI-only apply() (left untouched): detects the install kind
  at runtime (AppImage via the APPIMAGE env var, same FUSE-mount issue
  elevated_exe() already works around and this reuses; Deb otherwise
  on Linux; WindowsInstaller on Windows), matches the right release
  asset by the GUI bundle naming (_amd64/_aarch64.AppImage,
  _amd64/_arm64.deb, _x64-setup.exe), verifies SHA-256 when a sidecar
  is published, and installs:
  - AppImage: downloads to a temp file in the same directory, renames
    over the running file, execs it in place (same PID, already root).
  - .deb: runs dpkg -i directly (already root), execs current_exe()
    again now that dpkg replaced it on disk.
  - Windows: runs the installer silently and detached, exits
    immediately to release the file lock. Does not claim to relaunch
    the app afterwards — no documented NSIS or Tauri flag does that;
    needs a real Windows machine to confirm actual post-install
    behavior.
- Engine::update_apply_desktop wires it into the Tauri update_apply
  command (now takes AppHandle, emits update-progress events).
- Fixed a real gap: the existing update button handler changed its own
  label when an update was available but never actually called apply
  — wired it for real, with per-phase progress feedback in the
  interface's existing language (download/verify/install/restart).
- scripts/build-gui.sh: generates a checksum file next to every file
  in dist-gui/, matching the CLI release archive convention.
- 3 new unit tests: install-kind detection, GUI asset suffix matching
  against real release naming, existing CLI-refusal test unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

scripts/build-gui.sh

@@ -76,8 +76,6 @@ case "$platform" in
     rm -rf "$bundle/appimage" "$bundle/deb"
     tauri build --bundles appimage,deb
     cp "$bundle"/appimage/*.AppImage "$bundle"/deb/*.deb ../../../dist-gui/
-    # Include .sig alongside the bundle when updater signing is enabled.
-    cp "$bundle"/appimage/*.AppImage.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   linux-x86_64)
     if [ "$(uname -m)" = x86_64 ]; then
@@ -165,7 +163,6 @@ EOF
       tauri build --target x86_64-unknown-linux-gnu --bundles appimage,deb
     fi
     cp "$bundle"/appimage/*.AppImage "$bundle"/deb/*.deb ../../../dist-gui/
-    cp "$bundle"/appimage/*.AppImage.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   windows)
     rustup target add x86_64-pc-windows-msvc >/dev/null
@@ -173,9 +170,21 @@ EOF
     rm -rf "$bundle"
     tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc --bundles nsis
     cp "$bundle"/*-setup.exe ../../../dist-gui/
-    cp "$bundle"/*-setup.exe.sig ../../../dist-gui/ 2>/dev/null || true
     ;;
   *) echo "unknown platform: $platform" >&2; exit 2 ;;
 esac
 
+(
+  cd ../../../dist-gui
+  for asset in *; do
+    [ -f "$asset" ] || continue
+    case "$asset" in
+      *.sha256) ;;
+      *)
+        sha256sum "$asset" > "$asset.sha256"
+        ;;
+    esac
+  done
+)
+
 ls -1 ../../../dist-gui