v0.10.1

v0.10.1: update verification fails closed; CI test suite green

The new checks workflow caught a real bug on its first run, in code I wrote.

verify_app() shells out to codesign and spctl. If those tools can't be run at
all — a non-macOS host, a stripped system — subprocess raised a bare
FileNotFoundError instead of our UpdateError. Two consequences:

  * the user would have seen "Update failed: [Errno 2] No such file or
    directory: 'codesign'" instead of a comprehensible message, and
  * more importantly the failure mode was unclear at the exact moment it
    matters most: when we cannot verify an update we must refuse it.

_run_check() now wraps every verification call, converts OSError /
SubprocessError into a clean UpdateError, and adds a timeout. Verified it fails
CLOSED: with the tools removed from PATH, verify_app refuses the bundle rather
than letting an unverified one through.

Also fixes CI. I had claimed the test suite was stdlib-only and therefore safe
to run on Linux; that was wrong for test_selfupdate, which reached codesign
through verify_app. Checking only on macOS masked it. With the fail-closed fix
the test now passes on both platforms — confirmed by running the whole suite
with the macOS tools removed from PATH, and again normally.

New user-facing string translated into all six languages.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>