feat(updater): self-update via GitHub Releases with launch check and settings UI

Phase 3 of the 0.1.0 release prep:
- tauri-plugin-updater + tauri-plugin-process wired into the builder, with
  updater:default / process:allow-restart capabilities
- bundle.createUpdaterArtifacts: true; endpoint points at the GitHub
  releases latest.json, pubkey baked into tauri.conf.json
- store: update status state machine (check / download progress / install)
  with a quiet launch check (prod only) that stays silent on network errors
- UI: dismissible update toast with download progress, plus an Updates group
  in Settings > General showing current version and manual check/install

.github/workflows/ci.yml

@@ -47,7 +47,8 @@ jobs:
         working-directory: src-tauri
         run: cargo fmt --check
 
-      # Default features only — candle-cuda must never be enabled in CI.
+      # --no-default-features: default enables candle-cuda for the main dev
+      # machine; CI runners have no CUDA toolkit and must build CPU-only.
       - name: Clippy
         working-directory: src-tauri
-        run: cargo clippy --all-targets --locked
+        run: cargo clippy --all-targets --locked --no-default-features