Make selfupdate avoid GitHub API rate limits

selfupdate/MIGRATION.md

@@ -14,6 +14,7 @@ client := selfupdate.Client{
 	BinaryName:             "agentsview", // or "msgvault"
 	CurrentVersion:         version,
 	CacheDir:               appCacheDir,
+	GitHubToken:            selfupdate.EnvironmentGitHubToken(), // optional API fallback auth
 	AllowUnsignedChecksums: true, // current CLI releases publish SHA256SUMS only
 }
 ```
@@ -27,6 +28,50 @@ Use `client.Install(ctx, info, selfupdate.InstallOptions{Progress: progress})`
 where the current command calls `PerformUpdate`. CLI output, config loading,
 confirmation prompts, and command wiring should stay in the application.
 
+## Release Discovery
+
+By default, `Check` avoids unauthenticated `api.github.com` release discovery.
+It follows `https://github.com/<owner>/<repo>/releases/latest` to the release
+tag, constructs the conventional archive URL, and reads `SHA256SUMS` from the
+release downloads. If that web path fails, it falls back to the GitHub REST API.
+Set `GitHubToken` to authenticate only the API fallback request; kit never sends
+that token to release asset or checksum download URLs.
+
+Set `ReleaseManifestURL` when a project publishes a static latest-release JSON
+document, such as from a docs site or CDN. The smallest useful manifest only
+needs the current release tag:
+
+```json
+{
+  "tag_name": "v1.2.3"
+}
+```
+
+With only a tag, kit uses the same conventional release asset and `SHA256SUMS`
+URLs as web redirect discovery. Projects with custom asset URLs can instead
+publish the same compact shape as the GitHub release fields kit consumes:
+
+```json
+{
+  "tag_name": "v1.2.3",
+  "assets": [
+    {
+      "name": "agentsview_1.2.3_darwin_arm64.tar.gz",
+      "size": 123456,
+      "browser_download_url": "https://github.com/kenn-io/agentsview/releases/download/v1.2.3/agentsview_1.2.3_darwin_arm64.tar.gz"
+    },
+    {
+      "name": "SHA256SUMS",
+      "browser_download_url": "https://github.com/kenn-io/agentsview/releases/download/v1.2.3/SHA256SUMS"
+    }
+  ]
+}
+```
+
+When `ReleaseManifestURL` is set, kit uses it directly instead of probing
+GitHub's web or API endpoints. `GitHubWebBaseURL` and `GitHubAPIBaseURL` remain
+available for tests and GitHub Enterprise installs.
+
 Install verification fails closed by default and requires signed update
 metadata. The current agentsview and msgvault CLI release workflows publish
 archives plus `SHA256SUMS`, but not CLI update signatures or embedded public