Harden auto-updater trust chain (upstream gpui-updater follow-ups)

[AprilNEA]

Context

PR #66 added minisign signing/verification for updater artifacts and, on the
client, wrapped the update source in RequiredSignedSource
(crates/openlogi-gui/src/platform/updater.rs) to make update checks fail closed
— a workaround for gpui-updater verifying only on a best-effort, opt-in basis.

A review of gpui-updater (the pinned v0.0.3 dependency) surfaced several
hardening gaps that must be fixed upstream. They are tracked there in
AprilNEA/gpui-updater#1. This issue tracks the OpenLogi-side follow-ups.

Follow-ups here (once upstream lands)

• Bump gpui-updater past the require-verification release and replace the
  RequiredSignedSource wrapper with
  EngineConfig::verification(Verification::SignatureAndSha256) in
  crates/openlogi-gui/src/platform/updater.rs.
• If upstream adopts signed version/asset binding via the minisign trusted
  comment, update the Sign updater artifacts step in .github/workflows/release.yml
  to sign with minisign -S -t "version=<v>;file=<name>" (it currently signs
  with -W and no -t, so the trusted comment is just a timestamp).
• Confirm dev / Nix / Homebrew-from-source builds degrade gracefully:
  without OPENLOGI_UPDATE_MINISIGN_PUBLIC_KEY embedded, the updater now fails
  closed by design, so those builds must surface "updates not available for this
  build" rather than an update error.

Upstream gaps (summary — full detail in AprilNEA/gpui-updater#1)

1. High — Verification is fail-open; no way to require it.
2. High — Manifest version↔artifact binding is unauthenticated → rollback /
   substitution attack (a genuine, signed older build can be served as "new").
3. Medium — Unbounded manifest/signature/artifact reads → DoS.
4. Medium — HTTPS not enforced.
5. Low — TOCTOU between verify and install.
6. Low — install() re-accepts unverified artifacts.

Related: #66

[pullfrog]

Pullfrog paused this run — you've used your 100 free runs this month. Add a card to continue at 7¢/run. Add a card

[linear-code]

OLG-51