Give the update prompt a real dialog with a link to what's new

[jainnitin]

Why

The update prompt was a native ask() box — one run-on line with two version
numbers and a question, plus up to 400 characters of the release body pasted in.

That body was fixed CI text telling the reader to "download the installer for
your platform from the assets below" — advice that makes sense on a release
page and none at all inside an app that is about to do the downloading itself.
And there was no way to find out what had actually changed, which is the one
thing worth knowing when deciding whether to install now or later.

What changed

A real dialog, styled like the link and audit dialogs already in the app:

• The heading names the version on offer; the subtitle says which one you're
  leaving and that your work stays open.
• Release notes render in a scrollable panel, with boilerplate lines filtered
  out so only substance shows.
• "What's new" opens the full release page in a browser.
• Download progress is a determinate bar inside the dialog, replacing toasts
  that could sit behind another window unseen. Buttons disable in place, so
  nothing shifts under the pointer mid-download.
• The restart prompt offers "Restart now" and "On next launch" instead
  of OK and Cancel, which said nothing about what declining would do.

Real release notes. The workflow now sets generateReleaseNotes: true, so
releases carry GitHub's generated changelog and the panel has something worth
reading instead of the same paragraph every time.

Notes

• No new dependencies; the dialog is plain HTML and CSS like the rest.
• open_external_url already allow-lists schemes, so the link cannot be used to
  open anything local.
• Telemetry gains update_notes_opened, which shows whether anyone actually
  wants the changelog — worth knowing before investing further here.

Verification

• npm run preflight passes: build, tests, cargo fmt, clippy with warnings
  denied, workflow YAML, version agreement, credential scan.
• Dialog rendered against the real stylesheet with representative content, at
  the size it will appear.
• Not verified end to end: the download and restart path needs a real newer
  release to offer, which the next version bump will provide.