#8346 fix(desktop): wait for native update staging and verify installation

Summary

• Wait for native Squirrel staging before offering restart, including when a newer release replaces an already staged update. Retain an older staged build only while its native feed is still valid, and let failed native staging retry safely. Handle background check failures independently of native failures so they cannot cancel a confirmed restart.
• Record the staged version atomically and compare it with the version running on the next launch, so an interrupted installation is distinguishable from a completed upgrade.
• Exercise real Electron and MacUpdater downloads, replacement failures, cached retries, and installation checkpoints. This follows Electron's native update lifecycle.

Type of Change

• Bug fix

Testing

• 870 desktop tests; desktop type check and build.
• Real Electron/MacUpdater integration test, demonstrated failing against the original updater. JSON checks and HTTP request evidence are written to DESKTOP_UPDATER_REPORT_PATH or Playwright test results.
• Native verification and signed bundle replacement are simulated in the integration fixture; a signed release upgrade remains release validation.
• Repository lint, all 51 audits, block-registry checks, and docs-manifest check.
• Full local Electron run: 56 passed, 3 packaged-only skips, and 4 browser/password-picker failures. All 4 passed on focused reruns; the unpackaged shell exits updater initialization before the changed logic.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)