Stream self-update artifact downloads during update

[ryanfowler]

Summary

• Stream self-update artifacts instead of buffering the full archive in memory.
• Hash release assets on the fly before comparing against the published SHA-256.
• Use direct streaming extraction for .tar.gz/.tgz assets and a temp file for .zip assets, which still need seekable input.
• Update the repo notes to reflect the new self-update behavior.

Testing

• Added unit tests covering streamed tar.gz extraction, streamed zip staging, checksum verification, and size-limit handling.
• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --all-features