2.0.3

Make the macOS auto-update install reliable (no more re-download loop)

The old Squirrel-based updater validated code signatures, so an unsigned CI
build could never be applied over a locally-signed install: it downloaded,
"installed", relaunched the same version, and re-detected the update forever.
The custom updater already sidesteps that on the check side (reads the GitHub
API, not latest-mac.yml), but the mac install itself could still fail silently
when the app lived in /Applications.

Rework applyMac so the install actually sticks:
- stage the new bundle off the mounted dmg, wait for the app to exit, then swap
- if the app folder is writable, swap in place; if not (e.g. /Applications),
  do the swap under one osascript admin prompt instead of giving up
- on any failure, open the staged app / dmg for a manual drag and never
  relaunch the OLD bundle, so a failed install can't spin into a re-check loop
- log each step to ~/aether-update.log for diagnosis

Bump to 2.0.3.