feat(updater): wire startup check for desktop production builds

maybeEnableUpdater inits app.Updater (CurrentVersion from wails.json, embedded public key, accent-themed builtin window) behind two gates: -tags production (wails3 build sets it, dev does not) and application.System.IsDesktop (mobile stays on Obtainium). The startup check is headless; the window opens via a second CheckAndInstall only when an update is found. ANITRACK_UPDATER_CHANNEL=beta opts into -rc pre-releases for testing. updater_flow_test.go drives the REAL framework verifier headless: good signature stages byte-identical, tampered signature rejected (both phases green). Works around the framework process-wide app singleton with a single two-phase test.

updater_prod.go

@@ -0,0 +1,8 @@
+//go:build production
+
+package main
+
+// updaterAutoCheck gates the startup update check to production builds:
+// `wails3 build` sets -tags production, `wails3 dev` does not, so dev
+// binaries in build/bin never phone home.
+const updaterAutoCheck = true