feat(updates): implement signed atomic updates for macOS app bundles

Problem

Native reserves update configuration in app.zon, but applications must currently implement checking, downloading, signature verification, installation, and relaunch themselves.

https://native-sdk.dev/updates

This becomes particularly risky when an app contains helper executables. Updating the main binary and helper independently can leave an incompatible or partially updated installation.

Proposed initial scope

Implement a macOS-first update flow for a ZIP containing the complete .app bundle.

The application should explicitly control the flow through effects such as:

• Check for an update.
• Download an update.
• Receive download progress.
• Verify the artifact.
• Install and relaunch.

Updates must never install silently.

The existing feed_url and public_key fields should be used for discovery and Ed25519 verification.

Start by reading the update configuration in app.zon and the linked updates documentation, focusing on the existing feed_url and public_key fields. No implementation files or tests are named, so the repository entry point still needs to be identified. Done means an explicit macOS flow covers checking, downloading with progress, Ed25519 verification, atomic installation of the complete .app bundle, and relaunch without silent updates.