Defer update downloads until preparation

[mxcl]

Summary

• make check() fetch release metadata only
• expose the selected semantic version as Update.version
• defer DMG download, mounting, and signature validation to prepareInstallation()
• document the version 4 behavior and security boundary

Why

The main consumer needs to check for updates on startup and every 24 hours without repeatedly downloading or mounting the DMG. Previously, check() staged the full artifact before the caller decided to install it.

The check result remains advisory. prepareInstallation() retains the existing bounded download, Developer ID validation, protected promotion, second validation, rollback, and relaunch behavior.

Validation

• swift test — 56 tests passed
• Automic Vault consumer build passed against this local package
• Automic Vault consumer tests — 50 passed

[Copilot]

Pull request overview

This PR changes AppUpdater’s update flow so that check() performs lightweight update discovery (metadata only) and defers downloading/mounting/validation of the DMG until prepareInstallation(). It also exposes the selected semantic version on Update.version and updates docs/tests to reflect the new v4 behavior and security boundary.

Changes:

• Refactor check() to return a lightweight Update and defer artifact preparation to prepareInstallation().
• Add Update.version and adjust viable update selection to return both version + asset.
• Update README guidance and revise unit tests to validate the deferred preparation behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
AppUpdater.swift	Refactors update discovery vs preparation, adds Update.version, and adjusts viable-update selection return type.
Tests/AppUpdaterTests/AppUpdaterTests.swift	Updates tests to verify check() does not stage/download and that preparation happens during prepareInstallation().
README.md	Documents v4 behavior changes, including the security boundary between advisory metadata and authenticated candidates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mxcl]

@copilot do you consider your issue resolved?

[Copilot]

@copilot do you consider your issue resolved?

Yes — commit f048cc5 ("Validate update metadata during discovery") already resolves it. validateAssetMetadata (https scheme, content type, non-zero size, and max-download-size checks) is now called in check() before the Update is returned, so a false-positive advisory result that would always fail at preparation time is no longer possible.