Add Companion self-update flow

[davejohnson]

What changed

• compare the packaged Companion version with the latest published GitHub release
• offer a visible Restart and Update action only for a newer architecture-matching DMG with a GitHub SHA-256 digest
• verify the download, bundle identity/version, updater presence, and code signature before staging
• replace and relaunch through a native helper with rollback on replacement or relaunch failure
• package and sign the helper in both macOS release artifacts

Why

The bundled Hypervibe runtime otherwise stays fixed until the user manually downloads and reinstalls the app. This gives the Companion a safe, explicit update path before onboarding a coding agent.

Validation

• swift test --package-path apps/macos (34 tests)
• optimized release builds for HypervibeCompanion and HypervibeCompanionUpdater
• bash -n scripts/build-macos-installer.sh
• git diff --check