feat(ENG-850): wire shell auto-update runtime

[pnewsam]

Summary

Third PR in the ENG-850 stack. Depends on #506.

This connects the lifecycle engine to Electron and the renderer while keeping automatic shell updates disabled by default behind SHELL_AUTO_UPDATE_ENABLED=1|true.

• owns one authoritative main-process shell-update snapshot
• checks on boot, every four hours, and on demand; concurrent checks coalesce
• supports automatic download/quit install and manual download/restart modes
• exposes typed IPC/preload/host commands and full snapshot subscriptions
• persists the downloaded target and reconciles it after relaunch
• serializes UI/server apply and shell install through a shared maintenance gate
• renders available, progress, restart, retry, and terminal-failure states in Sidebar and Settings
• preserves the ENG-849 manual installer as the disabled/failure fallback

End result of this PR

With the hidden QA flag enabled in a packaged stable/prod build, the full automatic update experience is usable end to end. Without the flag, shipping behavior is unchanged.

Verification

• npm run typecheck
• npm test — 63 files / 645 tests passed
• npm run check:cowork-purity
• git diff --check

Stack

1. feat(ENG-850): add shell auto-update lifecycle foundation #505 — lifecycle/state-machine foundation
2. build(ENG-850): publish signed shell update feeds #506 — signed artifacts and updater feeds
3. this PR — runtime, IPC, UI, reconciliation, and maintenance coordination
4. follow-up — stable-channel rollout switch after signed N → N+1 smoke testing

Linear: ENG-850

[pnewsam]

Consolidated into #508, which now carries the whole ENG-850 stack as one PR (this runtime/IPC/UI slice included). Closing in favor of #508; branch left intact.

[pnewsam]

Correction: the consolidated PR is #521 (I mislabeled it #508 above — the branch rename auto-closed #508). All four ENG-850 slices now live in #521, stacked on #453.