feat(desktop): in-app Check for Updates / Update Now in Settings

[siracusa5]

Summary

• Settings → General now has a live "Check for Updates" control backed by the desktop app's existing electron-updater, and an "Update Now" button once a download completes — previously the only way to trigger a check was the app-menu dialog flow, and Settings showed just a toggle plus a static version number.
• New renderer-facing status channel: apps/desktop/src/main/updater.mjs forwards autoUpdater events (checking-for-update / update-available / download-progress / update-downloaded / error) through trusted IPC (updates:get-status / updates:check / updates:install, both windows) to window.__CC_DESKTOP.updates in the preload bridge. Additive — the menu's dialog-driven checkInteractive() is untouched and drives the same autoUpdater singleton.
• Browser/live mode gets a lighter parallel in the same row: a manual GitHub-releases check (checkForUpdate(..., { force: true }), bypassing the session cache UpdatePill relies on) with a link to the new release, since there's nothing to install in a browser. Demo mode shows nothing, matching the existing UpdatePill gating.

Affected area

• Core engine / MCP / write path
• Console
• Site
• Playground or local demo surfaces
• Docs / specs / contributor workflow
• Packs
• Desktop app (apps/desktop)

Validation

• npm test (root)
• npm --prefix apps/console run typecheck
• npm --prefix apps/console test (428 passed, incl. new coverage for both the desktop bridge flow and the browser manual-check flow)
• npm --prefix apps/console run build
• npm --prefix apps/site run build
• apps/desktop: npm test (104 passed), npm run test:navigation, npm run test:cli-status
• apps/desktop: npm run smoke — blocked locally by the already-running packaged /Applications/ContextCake.app holding the single-instance lock (shared userData path); relying on CI's clean runner for this one, will watch the required desktop CI job.

Compatibility

• Root commands still work, or the PR explains the migration path.
• No root npm dependencies were added.
• Generated files are ignored or intentionally committed.

Sign-off

• Every commit is signed off (git commit -s) per the
  Developer Certificate of Origin.