[BUG] Auto-update fails for all native installs: release channel pointers (latest/stable) return 403 AccessDenied from GCS

### What happened

Auto-update fails on every attempt with `install_failed`. Running `claude update` shows the underlying cause:

```
Current version: 2.1.241
Checking for updates to latest version...
Error: Failed to install native update
TelemetrySafeError: Failed to fetch version from https://downloads.claude.ai/claude-code-releases/latest after 3 attempt(s): Request failed with status code 403
```

### Root cause

The release-channel pointer objects return **403 AccessDenied** from GCS, unauthenticated:

```
$ curl -i https://downloads.claude.ai/claude-code-releases/latest
HTTP/2 403
content-type: application/xml; charset=UTF-8
server: UploadServer
via: 1.1 google

AccessDeniedAccess denied.
```

Versioned paths under the same bucket are still public and serve fine:

| Path | Status |
|---|---|
| `claude-code-releases/latest` | 403 |
| `claude-code-releases/stable` | 403 |
| `claude-code-releases/2.1.241/manifest.json` | 200 |
| `claude-code-releases/2.1.246/manifest.json` | 200 |
| `claude-code-releases/2.1.246/darwin-arm64/claude` | 200 (sha256 matches manifest) |

So the artifacts are published and readable — only the `latest` / `stable` channel pointers are inaccessible. GCS returns `403 AccessDenied` rather than 404 when the caller lacks list permission, so those objects may be missing rather than mis-ACL'd. Either way it's server side; nothing on the client can work around it.

### Not a local/network issue

- Native install (not npm), `claude doctor` reports "No installation issues found"
- No proxy / `NODE_EXTRA_CA_CERTS` / TLS interception in the environment
- No lock files, install dir is user-owned and writable, 452 GiB free
- Same 403 from plain `curl` outside the CLI, so it is not client code

### Impact

Every native-install user is stuck on whatever version they had when this started, with a persistent `✘ Auto-update failed · Run claude doctor` banner. `claude doctor` itself reports no problem, which sends people down the wrong path.

### Workaround

Install a specific version manually, bypassing the channel pointer:

```sh
V=2.1.246
curl -sSL -o ~/.local/share/claude/versions/$V \
"https://downloads.claude.ai/claude-code-releases/$V/darwin-arm64/claude"
chmod 755 ~/.local/share/claude/versions/$V
ln -sfn ~/.local/share/claude/versions/$V ~/.local/bin/claude
```

Verify the sha256 against `https://downloads.claude.ai/claude-code-releases/$V/manifest.json` first. Version numbers can be discovered from the npm registry (`@anthropic-ai/claude-code`) since the channel pointer is unreadable.

### Environment

- Claude Code 2.1.241 (native), commit c87e2742fc9a
- macOS darwin-arm64, Darwin 25.6.0
- Auto-update channel: latest
- First observed: 2026-08-26

Start by reproducing the unauthenticated requests to the latest and stable release-channel URLs with curl, then compare them with the versioned manifest and binary paths described in the report. Confirm that both channel pointers are publicly readable and that claude update no longer receives 403 AccessDenied; no repository file or test is named in the issue.

Written by the indexing model from the issue text.