feat: Add desktop OTA updater

[indapublic]

Redownloading the DMG isn't very convenient, so I’d like to discuss this PoC

[NovakPAai]

Hey @indapublic — thanks for tackling this, re-downloading the DMG on every update is exactly the pain worth fixing. Heads up for coordination: I independently built the same feature in #272, and it ended up a bit broader, so cross-linking here to avoid duplicate work.

Where #272 overlaps with this PR: electron-updater, the CODBASH_DESKTOP=1 guard so the web /api/update (npm -g) path can't run inside the packaged app, and a state-driven update banner.

Where #272 goes further:

• Windows (NSIS) target — this PR is macOS-only.
• macOS zip target — electron-updater's macOS updater (Squirrel.Mac) installs from a .zip, not a DMG, so a DMG-only latest-mac.yml typically won't actually apply the update on mac (worth verifying on your side — might be why it's still a PoC). feat: real in-app auto-update for the desktop app (electron-updater) #272 adds the zip target + blockmaps so the download installs in place.
• Security hardening (after a security review): a will-navigate guard pinning the window to the local-server origin, IPC sender-frame validation, and main-process state-gating before download/install. The updater IPC is powerful (force-download + quitAndInstall), so it shouldn't be reachable by any off-origin page.
• A regression test for the desktop /api/update 400 guard.

One thing this PR does that #272 doesn't: regenerate-latest-mac.js nicely automates the post-stapling feed regeneration — I left that as manual RELEASE.md commands. I'd like to fold that script in regardless of which PR lands.

@vakovalskii — your call on how to reconcile these. Suggestion: take #272 as the base (Windows + mac zip + hardening + test) and cherry-pick @indapublic's regenerate-latest-mac.js on top, then close this one — but happy to do it the other way round if you'd prefer. Credit to @indapublic for the script either way.