Expose update download targets (codex)

[numnx]

🧩 Task: Expose update download targets

Automated task PR opened by Code UX for T01.

📋 Summary

Sprint: Sprint 156 · Chat Status widget + Update downloadlink · Task: T01

Connect the chat rich status widget to live sprint/task progress and make update notices open the correct official npm or Electron release download in the user’s browser.

📝 Full Task Prompt

## Objective
Extend `/api/system/update-status` so consumers can choose the correct official download target for npm installs or Electron desktop updates while preserving the existing release URL behavior.

## Scope
- `src/services/update-checker-service.ts`
- `src/server/update-status-routes.ts`
- `dashboard/src/v2/lib/system-api.ts`
- `tests/backend/services/update-checker-service.test.ts`
- `tests/backend/server/update-status-routes.test.ts`
- `docs/operations/runbook.md`
- Symbols: `UpdateStatus`, `UpdateCheckerService.checkForUpdate`, `/api/system/update-status`, `fetchUpdateStatus`

## Implementation Requirements
1. Add typed update download target fields to the backend response, for example a `downloadTargets` object with `npm` and `electron` entries that include at least `url`, `label`, and a stable target kind.
2. Build the npm target from the resolved latest version using the official npm package URL for `@codeuxai/codeux`, and build the Electron target from the official GitHub release tag URL for the same version; keep the existing `releaseUrl` field for backward compatibility.
3. Ensure failure responses remain safe: no update available, `latestVersion: null`, existing releases fallback URL, and download targets either omitted or set to documented stable fallback values that cannot point at an untrusted host.
4. Update `dashboard/src/v2/lib/system-api.ts` so the dashboard has the new typed fields without using `any`.
5. Add backend tests for successful latest-version responses, cached responses, and registry failure responses, including assertions for npm and Electron target URLs.
6. Update the runbook entry for `/api/system/update-status` to document that the response includes npm and Electron download targets.

## Constraints
- Do not remove or rename existing `UpdateStatus` fields consumed by the dashboard.
- Do not call GitHub from the update checker; the current npm registry lookup remains the only network lookup.
- Keep all generated URLs constrained to official `npmjs.com` and `github.com/codeux-ai/codeux` destinations.
- Do not introduce a separate update settings store or database table.

## Verification
- Run `pnpm run test:backend -- tests/backend/services/update-checker-service.test.ts tests/backend/server/update-status-routes.test.ts`.
- Run `pnpm run lint`.
- Success means `/api/system/update-status` still returns the previous fields and now also returns correct official npm and Electron download targets for the latest version.

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-07 04:20:40 UTC
Finished	2026-07-07 04:24:45 UTC
Duration	4m 5s

📊 Token Usage

Metric	Value
Input tokens	64,128
Cached input tokens	651,392
Output tokens	8,199
Total tokens	723,719
Invocations	1
Tool calls	42
Active time	3m 36s

Included usage estimate (subscription/local login): $0.89

🌿 Branch Info

Base: feature/CODUX-156-chat-status-widget-update-downloadlink
Head: task/feature-codux-156-chat-status-widget-update-down-t01-codex-mra55byg

---

🤖 Generated by Code UX