Move UpdateController's feed URL check into UpdateGate and test it

## What happens

`Sources/Uttrflow/Updates/UpdateController.swift:59-63`, `isAcceptable(_:)`, accepts an update feed only over `https`, or over `http` when the host is `127.0.0.1`, `localhost` or `::1` (so an update can be rehearsed on one Mac). The file is excluded from coverage (`Scripts/coverage_report.py`: "the only rule it holds — when an update may install — is UpdateGate, which is tested"). But this is a second rule, and no test calls it: `grep -rn isAcceptable Tests` finds nothing.

Measured on origin/main `26d7bc1` with `swift test --enable-code-coverage` (5,384 tests, all passing) and `xcrun llvm-cov export` over the test binary. The regions named below have an execution count of 0: no test runs them, so a change that breaks them passes `make verify`.

## Why it matters

This check decides which feeds the updater will trust. Reading the code today, it looks right: a host such as `127.0.0.1.example.com` doesn't match. But nothing stops a later edit to `hasPrefix` or `contains` from accepting a plain-`http` feed on another host, and the exclusion reason tells reviewers there is nothing here to test.

## How to reproduce

Read `Scripts/coverage_report.py` (the exclusion reason for `Uttrflow/Updates/UpdateController.swift`) and `Sources/Uttrflow/Updates/UpdateController.swift:59-63`. Run `grep -rn isAcceptable Tests`.

## Acceptance criteria

- The rule moves into `UpdateGate` (or a sibling type in `UttrflowUX`, which is covered) as a pure function, and `UpdateController` calls it.
- Tests accept `https://example.com/appcast.xml`, `http://127.0.0.1:8080/a.xml`, `http://localhost/a.xml` and `http://[::1]/a.xml`.
- Tests refuse `http://example.com/a.xml`, `http://127.0.0.1.example.com/a.xml`, `http://localhost.example.com/a.xml`, `http://localhost@example.com/a.xml`, `ftp://127.0.0.1/a.xml` and `file:///tmp/a.xml`.
- The exclusion reason in `coverage_report.py` is updated to name only what is left in the file.
- Each new test fails when the branch it covers is broken. Check this by hand before opening the PR: temporarily change the branch (flip the condition or return the other value), see the test fail, then restore it.

## Where to start

- `Sources/Uttrflow/Updates/UpdateController.swift`, `Sources/UttrflowUX/UpdateGate.swift` (find it with `grep -rn "struct UpdateGate\|enum UpdateGate" Sources`), `Tests/UttrflowUXTests/UpdateGateTests.swift`.
- Umbrella: #641.

Read `CONTRIBUTING.md` first. Iterate with `swift test --filter `, then run `make verify` before pushing. Only tests change; no product code needs to.

**Size:** S.

Read CONTRIBUTING.md, then inspect Sources/Uttrflow/Updates/UpdateController.swift, Sources/UttrflowUX/UpdateGate.swift, Tests/UttrflowUXTests/UpdateGateTests.swift, and the exclusion in Scripts/coverage_report.py. Run the filtered UpdateGate tests first; done means the listed HTTPS, localhost, IPv4, IPv6, invalid-host, scheme, and file URL cases are covered, UpdateController delegates the rule, and make verify passes.

Written by the indexing model from the issue text.