fix(desktop): gate updater by stable build identity / 按正式构建身份限制桌面更新器

[SivanCola]

Summary

• gate every production-updater boundary behind immutable build identity: exact stable channel plus an exact vX.Y.Z release version
• expose updaterEnabled through the Desktop startup/settings contract and default missing or invalid frontend values to disabled
• rename the user-facing Updates page to About while preserving the internal updates route for compatibility
• hide all update controls and production download links in canary, preview, test, dev, and prerelease builds
• throttle automatic checks across startup, focus, visibility, timers, remounts, and restarts to one attempt per six hours; manual checks still bypass the throttle
• keep stable updates explicit: checks only read metadata, and download/install/restart only begins after the user clicks the action

Compatibility

• no config.toml schema or persisted user preference migration
• old frontends ignore the additive RPC field
• new frontends treat a missing updaterEnabled field or startup-settings failure as disabled
• the existing desktop.check_updates preference remains intact for users returning from a test build to a stable build

Security and privacy

• non-stable builds cannot create the updater HTTP client, download payloads, launch installers, open the production download page, or trigger updater restart paths
• this change adds no dependency, telemetry, credential access, or new update endpoint

Related PR

• overlaps fix(desktop): coalesce the update checks fired by window focus and visibility #10250 in UpdateBanner.tsx; this PR addresses the same repeated-network-check symptom at the shared updater scheduling boundary with a persisted six-hour throttle, while also covering startup, timers, remounts, manual bypass, and build-level updater disablement

Verification

• cd desktop && go test -timeout 20m ./...
• pnpm --dir desktop/frontend test:updater
• pnpm --dir desktop/frontend test:app-lifecycle
• pnpm --dir desktop/frontend typecheck
• pnpm --dir desktop/frontend build
• Desktop contract regeneration and drift checks passed
• Windows x64 Electron shell packaging reached the unsigned NSIS stage in a Win11 ARM64 VM using x64 emulation

Packaged installation validation was intentionally not performed for this PR.

Documentation-impact: none - the user-facing behavior and explanatory copy are updated in the About settings surface; no external configuration schema or release procedure changes.

[SivanCola]

Author review summary (not an approval)

Reviewed head 6b129e76ed5b4f6953863529e741bd25722bfad8 against base 95b21354e367f991363ae3e3dc507a554a9f4ef6. I found no blocking correctness, security, compatibility, race, or performance issue in the updater changes.

Architecture and behavior:

• The immutable build capability gates CheckUpdate, ApplyUpdateRequest, OpenDownloadPage, and AbandonPendingUpdate before network, cache, installer, browser, or restart side effects.
• Only exact stable + vX.Y.Z builds can use the production updater; canary, preview, test, dev, and prerelease identities fail closed.
• Automatic checks persist an attempt timestamp before the RPC and are throttled across startup, timers, focus, visibility, remounts, and restarts to one attempt per six hours. Manual checks remain explicit and bypass the throttle.
• Available updates only publish UI state. Download, verification, installation, and restart remain behind the user action.

Compatibility and security:

• updaterEnabled is additive in the Desktop contract. Old frontends ignore it; new frontends treat a missing or failed value as disabled.
• The existing desktop.check_updates preference and config schema are unchanged.
• No dependency, credential access, telemetry, hidden persistence, or updater endpoint was added. The change reduces non-stable build privileges.

Verification:

• go test -timeout 20m ./... passed locally
• focused updater policy tests and focused -race tests passed
• updater scheduling and About capability tests passed
• app lifecycle tests, typecheck, production frontend build, contract drift check, repolint, and git diff --check passed
• all PR checks passed, including desktop-go-race, Windows Go groups, desktop frontend/browser jobs, CodeQL, and app-memory screening

Residual validation boundary:

• Packaged Windows installation was intentionally not performed. PR CI validates Windows compilation and Go behavior; the PR package job is skipped by repository policy.
• This PR overlaps fix(desktop): coalesce the update checks fired by window focus and visibility #10250 in UpdateBanner.tsx and supersedes its narrower focus/visibility coalescing with a shared persisted six-hour scheduler plus build-level updater gating.

The PR is technically ready for an independent maintainer review and merge.