Desktop updates under administrator control #103

Part of #98.

Today

• Where updates come from: the desktop app checks GitHub Releases through Velopack's GithubSource one minute after start and every 12 hours (DesktopUpdater.cs, App.cs). It downloads updates automatically and applies them silently on the next quit (WaitExitThenApplyUpdates(update, silent: true, …)).
• Who can turn it off: only the user, with the per-user toggle CheckForUpdates in desktop.json (on by default, DesktopPreferences.cs).
• Overriding the source: SEMANTICROUTER_UPDATE_SOURCE accepts any URL or folder, including plain http://.
• What protects an update: HTTPS plus the hashes in the releases.*.json feed, which comes from the same GitHub release. There is no separate publisher-signature check, and the packages are unsigned today (see the signing issue).
• How it's installed: per user into %LocalAppData% / ~/Applications, with no admin rights. There is no MSI or machine-wide package for Intune/SCCM/Jamf.
• What it leaves running: it persists through HKCU Run, a launchd agent and a systemd user unit.

Why it blocks adoption.

• Change management. Code can change on every desktop within 12 hours of a release, with no one in IT approving it.
• Supply chain. Whoever controls the GitHub account or the release workflow controls every install. Endpoint teams treat self-updating per-user apps with suspicion for exactly this reason.
• Deployment. A per-user installer is also awkward to deploy and inventory centrally.

Proposal

• Machine-wide update policy (see the machine-wide policy issue): Updates: Off | Notify | Auto, and UpdateFeed pinned to an internal mirror, read from HKLM / managed preferences / /etc. When set, the in-app toggle is locked and says "managed by your organization".
• Verify the publisher before applying: Authenticode on Windows, a Developer ID team check on macOS. Alternatively, a signed feed (minisign or Sigstore) whose key ships in the app, so a compromised release asset alone isn't enough.
• Refuse http:// update sources except file:// and loopback.
• Document mirroring: how to mirror the Velopack feed internally (it's static files) and point UpdateFeed at it.
• Managed install packages: an MSI (or MSIX) for Windows that installs per machine, and a .pkg that installs to /Applications. Updates for those come from the organization's own tooling, with the in-app updater off.

Open questions

• Is "Notify" (show the update, don't apply it) a better default for everyone, not just managed installs? Silent apply-on-quit surprises even individual users.
• Does Velopack support a signature check hook, or does this need a wrapper around UpdateManager?
• Is MSIX worth it, given its sandbox restrictions on spawning CLIs and binding ports?

Acceptance

• A machine policy turns updates off or pins the feed, and the user can't override it (test).
• An update package whose signature doesn't match the expected publisher is refused (test with a self-signed package).
• docs/desktop.md has a "Managed deployment" section.