#28120 carry of #27499: repair pulled updater races

Carry of #27499: cmux NEXT updater repair.

This carries the original purpose of #27499 and fixes all three P2 findings from its latest BLOCK review:

• an answered appcast probe settles the install click without waiting for a slow pulled-list read;
• known pulled staged builds are never installed when Sparkle cannot cancel them;
• pulled available builds are hidden, cannot be clicked, and their stale Sparkle reply is dismissed.

Original PR: https://github.com/manaflow-ai/cmux/pull/27499

No capture: no UI change; updater state behavior only.

Agent-Session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Carries #27499: the cmux NEXT updater installs the newest build and never offers a pulled one.

Restart to Update now re-reads the feed and pulled list on every install click, even when found updates wait for a click to download, so one click installs the newest build instead of whatever was staged first. A pulled build is never installed: a staged pulled build is dropped and the newest good build downloads, and a pulled running build updates to the newest good one. A "Getting the Newest Build…" card shows progress while the replacement downloads. The "This Nightly Was Pulled" banner with Wait for the Fix and Roll Back is removed.

Bug Fixes

• An answered feed probe settles the install click without waiting for a slow pulled-list read.
• A pulled staged build is never installed even when Sparkle cannot cancel its installer; the update sheet opens instead.
• A pulled build stays pulled for the process lifetime: a failed list read never forgets it, and one staged again is dropped without another fetch.
• Pulled available builds are hidden, cannot be clicked, and their stale Sparkle reply is dismissed.

No UI capture: updater state behavior only.