[Bug]: App silently quits without any warning when auto-update installs — kills all active PTY sessions mid-work

## Summary

When Orca's auto-updater finishes downloading a new version in the background, it immediately quits and installs without showing any confirmation dialog or warning to the user. All active terminal sessions, agent sessions, and PTY processes are forcibly killed at the moment of quit. From the user's perspective the app simply disappears mid-work with no explanation.

---

## Environment

- **OS**: macOS 26.4 (Darwin 25.4.0 arm64e)
- **Hardware**: MacBook Air M5, 24 GB RAM (Mac17,3)
- **Orca versions where this was observed**: v1.4.134 install (from v1.4.128), v1.4.135 install (from v1.4.134)

---

## Confirmed Occurrences

Both events were captured in `~/Library/Application Support/orca/logs/main.trace.ndjson` as `updater.install` spans.

### Occurrence 1 — Install of v1.4.134

**Timestamp**: 2026-07-10 23:00:08 CST
**Running version at time of quit**: v1.4.128
**Installed version**: v1.4.134

Event chain recorded in trace:
```
pre_quit_cleanup_start
pre_quit_cleanup_done
native_quit_and_install_invoked
local_pty_kill_all ← all terminal/PTY sessions forcibly killed
window_close_listeners_removed
```

The session that was running at the time (started 07-10 22:40, 20 minutes prior) was terminated with no warning.

### Occurrence 2 — Install of v1.4.135

**Timestamp**: 2026-07-11 13:51 CST
**Running version at time of quit**: v1.4.134
**Installed version**: v1.4.135

Same event chain. The session had been running for 64 minutes with an active agent (heap at 87 MB, mid-task).

---

## Update Download Behavior

The updater downloads silently in the background. Evidence from the updater cache:

```
~/Library/Caches/orca-updater/pending/Orca-1.4.135-arm64-mac.zip (189 MB, downloaded 2026-07-11 14:55)
~/Library/Caches/Homebrew/Cask/orca--1.4.133.dmg
~/Library/Caches/Homebrew/Cask/orca--1.4.128.dmg
```

As of 2026-07-11 14:55, a new update zip is already staged in the pending directory. This means another silent quit-and-install is imminent whenever Orca decides to apply it.

---

## Impact

1. **All PTY sessions killed** (`local_pty_kill_all`) — any running terminal commands, build processes, or agent tasks are lost without warning
2. **No opportunity to save work** — the `pre_quit_cleanup` window appears to be internal bookkeeping only; there is no user-facing prompt
3. **Unpredictable timing** — the quit happens at an arbitrary time after the download completes, which can be in the middle of an agent run or a long build

---

## Expected Behavior

Before quitting to install an update, Orca should:
1. Show a notification or dialog: *"An update is ready to install. Restart now or later?"*
2. Allow the user to defer the restart until they are not mid-task
3. If the user accepts, gracefully stop active agent sessions before killing PTYs (or at minimum warn that sessions will be lost)

This is standard behavior in most Electron apps using `electron-updater` — the `autoInstallOnAppQuit` option or a manual `quitAndInstall(false, false)` call with a dialog would address this.

---

## Log Evidence

Data extracted from:
- `~/Library/Application Support/orca/logs/main.trace.ndjson` — `updater.install` spans with full event arrays
- `~/Library/Caches/orca-updater/pending/` — staged update zip confirming another pending install