feat(updater): wire startup check for desktop production builds

maybeEnableUpdater inits app.Updater (CurrentVersion from wails.json, embedded public key, accent-themed builtin window) behind two gates: -tags production (wails3 build sets it, dev does not) and application.System.IsDesktop (mobile stays on Obtainium). The startup check is headless; the window opens via a second CheckAndInstall only when an update is found. ANITRACK_UPDATER_CHANNEL=beta opts into -rc pre-releases for testing. updater_flow_test.go drives the REAL framework verifier headless: good signature stages byte-identical, tampered signature rejected (both phases green). Works around the framework process-wide app singleton with a single two-phase test.

main.go

@@ -38,6 +38,9 @@ func main() {
 	svc = NewApp(app)
 	app.RegisterService(application.NewService(svc))
 
+	// Self-updates: desktop production builds only (no-op elsewhere).
+	maybeEnableUpdater(app)
+
 	app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Title:            appTitle(),
 		Width:            1024,