Add Sparkle and notarized DMG distribution

[tcballard]

What changed

• add Sparkle 2.9.2 to the Developer ID app with a pinned, checksum-verified official binary
• keep the Mac App Store target separate and entirely Sparkle-free
• expose manual update checks from the app menu and menu-bar context menu
• produce a signed, notarized drag-to-Applications DMG alongside the existing ZIP
• generate and upload an EdDSA-signed appcast.xml
• verify the final ZIP, mounted DMG, Sparkle metadata, notarization ticket, and Gatekeeper result before release
• move the shared 0.1.1 release identity to build 7

Verification

• Developer ID Debug target builds and embeds Sparkle.framework
• App Store Debug target builds without Sparkle or SUFeedURL / SUPublicEDKey
• real Developer ID Release signing succeeds for the app, Finder extension, Sparkle framework, updater app, and XPC services
• 71 Swift tests pass; the three Vision OCR fixtures fail in the restricted automation environment with CRImageReaderError, unchanged and unrelated to this change
• generated Xcode project is byte-identical to the checked-in project
• shell syntax, plist lint, and git diff --check pass

Release gate

No release was published from this branch. After squash merge, the notarized assets must be built from the exact origin/main commit before the draft release can be created and published.