install macOS .app directory bundles

[jaemk]

Implements the macOS .app support from specs/bundle-install.md (spec merged in #198). Closes #145.

Setting bundle_path_in_archive(..) selects bundle mode: the named directory inside the archive replaces bundle_install_path(..) as one unit, instead of a single file replacing bin_install_path. A .app bundle's resources and code signature have to move with its executable, so a file-at-a-time replacement cannot work.

self_update::backends::github::Update::configure()
    .repo_owner("me")
    .repo_name("MyApp")
    .bin_name("MyApp")
    .bundle_path_in_archive("MyApp.app")     // bundle_install_path defaults to the
    .current_version(cargo_crate_version!()) // running exe's enclosing .app on macOS
    .build()?
    .update()?;

• Add the bundle_path_in_archive / bundle_install_path setters to the shared builder surface, threaded CommonBuilderConfig -> CommonConfig -> FinishCtx so the sync and async finish tails stay identical. build() rejects bundle mode combined with an explicit bin_install_path or bin_path_in_archive as Error::ConflictingConfig, and a bundle_install_path without the archive path as Error::MissingField.
• Resolve the install path on macOS from the nearest .app ancestor of current_exe() when unset: Error::NoAppBundle when there is none, Error::AppTranslocated for a quarantined app running from a read-only translocated mount. Other targets require the setter.
• Swap by rename: extract into a temp dir inside the destination's parent (so every rename is same-filesystem, no copy fallback), stash the displaced tree, rename the staged tree into place. A failure at any step reverses the applied renames and returns the original error. A running executable inside the bundle is renamed aside first, so its path holds the new executable afterwards and no self_replace call is involved.
• Run verify_binary against the staged bundle root, and point the opt-in check_install_path_writable preflight at the bundle's parent.
• Add Error::NoAppBundle, Error::ConflictingConfig, Error::AppTranslocated. Error is #[non_exhaustive], so these are additive.

bin_install_path mode is untouched: bundle mode is only reachable through the new setter.

CI

macOS had no job at all, so the .app path resolution had never been compiled, and the windows job's feature list had drifted from the Makefile.

• Add a macos job (macos-latest, arm64) running the reqwest and ureq test lanes. Beyond the bundle swap this covers APFS's case-insensitive filenames, macOS symlink and rename semantics, and self_replace. None of that is architecture-dependent, so no x86_64 runner is used.
• Hoist REQWEST_FEATURES / UREQ_FEATURES into workflow-level env, consumed by the windows, macos, and msrv jobs. This restores gitee, manifest, and compression-tar-xz coverage on windows, and makes msrv build the full set its comment already claimed (cargo +1.88.0 build passes, so the declared MSRV does not move).
• Add make check/workflow-features, wired into check, so a future drift between those env values and the Makefile fails CI.

Also carries the design for the shared-egress-IP case in specs/auth-token-from-env.md (auth_token_from_env() plus a distinct Error::RateLimited), unimplemented here. Behind one NAT'd public IP the 60/hour unauthenticated GitHub REST budget is pooled across every client, so an update check can 403 through no traffic of its own.

Notes

• The whole-tree swap is not coordinated between concurrent updaters (BNDL-5-5), same as the existing single-file install.
• A caller-supplied .. in bundle_path_in_archive can point outside the staging dir. Unchanged from the bin_path_in_archive contract; the traversal guard covers the templated release version, which is the part callers do not control.
• Windows in-bundle swaps are allowed but can fail on a locked file. Documented, not worked around.
• Still needs a human on a signed build: codesign --verify after a swap, Gatekeeper, a quarantined copy, Finder launch, and relaunch via restart(). Tracked in the spec's manual matrix.