Automatic update checks cannot be turned off: the Settings switch controls only automatic installs

## What happens

- `Info.plist` sets `SUEnableAutomaticChecks` to true, with `SUScheduledCheckInterval` at 21600, every 6 hours (`Resources/Uttrflow-Info.plist:68-71`).
- At launch the app calls `updates.begin(automatically: settings.installsUpdatesAutomatically)` (`Sources/Uttrflow/AppDelegate.swift:225`).
- `begin` always sets `updater.automaticallyChecksForUpdates = true` (`Sources/Uttrflow/Updates/UpdateController.swift:69`). Only `automaticallyDownloadsUpdates` follows the setting, which defaults to on (`Sources/UttrflowSettings/SettingsStore.swift:91`).

So every running copy contacts `api.uttrflow.com` every 6 hours, and nothing in the app stops it short of blocking the host. Each check is otherwise minimal: `feedParameters` returns nothing (`UpdateController.swift:178-182`, `Docs/app-updates.md:44-47`). The request still reveals the Mac's IP address, the app version (in the user agent) and when the Mac is on.

A related detail for contributors: only `bundle.sh development` strips the feed (`Scripts/bundle.sh:143-145`). A plain `make app` (local mode) keeps the production feed and key, so a contributor's ad-hoc build checks the production server and offers to replace itself with the release.

## Why it matters

The product is sold on staying offline once models are installed. Some users (air-gapped or regulated environments, people on metered links, people who simply want no background traffic) will expect a way to update only when they ask. Sparkle supports this directly.

## Decision needed

1. Offer "Check for updates automatically" as its own switch, with "Install automatically" nested under it, the pattern Sparkle's standard UI uses. Or state in `Docs/offline.md` and the privacy copy that update checks always run.
2. Whether `local` builds should strip the feed as `development` builds do.

## Acceptance criteria

- The choice is reflected in `Docs/app-updates.md` and `Docs/offline.md`.
- If a switch is added, `UpdateController.begin` / `setInstallsAutomatically` honour it, with tests on `UpdateController`'s settings mapping, and "Check Now" keeps working with checks off.

Start with Sources/Uttrflow/Updates/UpdateController.swift, Sources/UttrflowSettings/SettingsStore.swift, and the referenced Info.plist and bundle.sh sections. Trace the settings mapping and existing Check Now behavior, then review Docs/app-updates.md and Docs/offline.md. Done means the chosen check/install behavior, local-build behavior, documentation, and UpdateController settings tests agree.

Written by the indexing model from the issue text.