Add roborev release discovery support

[cpcloud]

Summary

• Add a selfupdate mode that follows GitHub's HTML /releases/latest redirect and constructs release download URLs from the discovered tag.
• Add a tar.gz asset namer for release layouts that publish tarballs on every platform, including Windows.
• Add a handoff plan for migrating roborev's internal updater onto kit.

Validation

• go build ./...
• go tool gotestsum --format pkgname-and-test-fails -- ./...
• go vet ./...
• go run ./cmd/testify-helper-check ./...
• go tool nilaway -include-pkgs=go.kenn.io/kit ./...
• nix run 'nixpkgs#golangci-lint' -- run

[cpcloud]

This is not right just yet.

[roborev-ci]

roborev: Combined Review (ee02f07)

Verdict: One medium issue needs attention; no high or critical findings were reported.

Medium

• selfupdate/selfupdate.go:1135 - Redirect discovery builds release download, checksum, and signature URLs by interpolating the raw tag and asset name into the path. Valid GitHub tags can contain /, so a redirect tag like cli/v1.2.0 becomes /releases/download/cli/v1.2.0/... instead of an escaped tag segment, which can break asset probing and downloads.
  • Fix: Path-escape the tag and asset name segments when building GitHub download URLs, and add a redirect-mode test covering a tag containing /.

---

Panel: ci_default_security | Synthesis: codex, 7s | Members: codex_default (codex/default, done, 3m31s), codex_security (codex/security, done, 3m24s) | Total: 7m2s | Job: 19840

[cpcloud]

Closing this because the direction changed: roborev should adopt kit's existing updater and GitHub release discovery instead of adding roborev-specific release discovery behavior to kit. No kit change is needed here; the follow-up work belongs in the roborev repo.