Enable unsigned early-access updates

[yaacovcorcos]

What

• add an explicit fail-closed allow_unsigned_release lane for manual early-access releases
• keep Windows on the normal in-app installer flow while unsigned macOS updates open the downloaded archive in Finder for guided replacement
• embed signing metadata in desktop artifacts and surface platform-accurate update/download guidance
• document the temporary lane and update the website copy

Why

This lets the project publish an updater-enabled bootstrap release before Apple and Windows signing credentials are available, without weakening the normal signed-release gate.

Impact

Existing v0.5.6 installations still require one manual bootstrap install because updater checks were compiled off in that version. Releases installed from this change can check and download future updates in-app.

Checks

• bun fmt
• bun lint (0 errors; repository warnings only)
• bun typecheck
• focused desktop updater tests: 42 passed
• focused web updater tests: 36 passed
• marketing release-feed tests: 9 passed
• bun run workflow:check
• bun run build:desktop
• bun run build:marketing
• repository-wide tests completed 12/13 packages locally; server Vitest became idle after its completed tests and was stopped after 5 minutes; required CI is authoritative for the full suite