feat(ENG-850): enable stable shell auto-updates

[pnewsam]

Summary

Fourth and final implementation PR in the ENG-850 stack. Depends on #507.

This is intentionally a small rollout-only change:

• enables automatic shell updates by default for the stable build ring
• keeps prod disabled by default for a later observation-based promotion
• supports SHELL_AUTO_UPDATE_ENABLED=false as the emergency stable kill switch
• preserves explicit true as a prod QA opt-in
• fails closed for preview/dev/unknown builds and invalid overrides

Merge gate

Keep this PR in draft until the artifacts from #506 and runtime from #507 pass a signed packaged N → N+1 smoke on both supported platforms:

• stable macOS downloads, verifies, restarts, and reports the new version
• stable Windows downloads, verifies, restarts, and reports the new version
• interrupted download can retry
• forced install failure retains the manual installer fallback
• UI/server maintenance cannot overlap shell installation

After merge, observe the stable ring before changing the same pure policy to enable prod by default. That prod promotion is an operational one-line policy change, not another architecture PR.

Verification

• npm run typecheck
• npm test — 64 files / 648 tests passed
• npm run check:cowork-purity
• git diff --check

Stack

1. feat(ENG-850): add shell auto-update lifecycle foundation #505 — lifecycle/state-machine foundation
2. build(ENG-850): publish signed shell update feeds #506 — signed artifacts and updater feeds
3. feat(ENG-850): wire shell auto-update runtime #507 — runtime, IPC, UI, reconciliation, and maintenance coordination
4. this PR — stable rollout policy

Linear: ENG-850

[pnewsam]

Auto-closed by a branch rename (the old head paul/eng-850-enable-stable-shell-auto-updates was replaced by paul/eng-850-shell-auto-update). The full ENG-850 stack is consolidated in #521.