Fix native Windows checks against the GitHub release feed

[coneilen]

Summary

Make native Windows update checks work against GraphCode's real GitHub release feed, without enabling installer download or relaunch. The old default repository returned 404 and the strict decoder rejected normal GitHub metadata; existing updater tests were not included in the shell gate.

Changes

• Point the native WinHTTP client at scgopi/GraphCode/releases?per_page=30. Accept additive GitHub metadata while retaining type checks on consumed fields.
• Keep the existing greatest-eligible-version selection, stable/beta filtering, cancellation, and generation checks. Propagate allocation failures instead of interpreting them as invalid release tags, and clean up partial results.
• Transfer accepted result ownership into App rather than allocating duplicate strings that could silently fail.
• Restrict release-page browser handoff to this repository's HTTPS release overview/single-segment version-tag pages. Reject encoded paths, dot segments, backslash separators, and query/fragment additions so browser normalization cannot escape that path. Correct the fallback and UIA fixture URLs.
• Keep startup/settings checks non-modal. Explicit Check for Updates and banner clicks can present the offer; background checks only update status/sidebar state.
• State clearly that the offer is for project release notes, assets may target other platforms, and Windows install/relaunch are not available.
• Wire native updater tests into the existing shell gate and guard that wiring in the validation-runner contract.

Test plan

RED: zig test graphcode-windows\src\WindowsUpdates.zig -target x86_64-windows-msvc -lc -lwinhttp with pinned provider headers -> wrong default repository, UnknownField on realistic release metadata, and MemoryLeakDetected during allocation-failure injection; 3 new tests failed.

GREEN: The same native updater command with pinned headers -> all 18 tests pass, including real-response shape, malformed consumed fields, channel/version selection, trusted browser destinations, non-modal background checks, cancellation, and exhaustive allocation failures.

REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\WindowsShell.Tests.ps1 -ZigExecutable $env:GRAPHCODE_ZIG0152 and ValidationRunner.Tests.ps1 -> pass; the actual ReleaseSafe shell build with pinned Winghostty also passes. zig fmt --check graphcode-windows\src\WindowsUpdates.zig and git diff --check pass.

A local executable using the real default CheckClient/WinHTTP path, not a rewritten HTTP client, fetched:

• Stable: v0.1.72, https://github.com/scgopi/GraphCode/releases/tag/v0.1.72
• Beta: 0.1.73-beta3, https://github.com/scgopi/GraphCode/releases/tag/0.1.73-beta3

Follow-up RED/GREEN: the release-page test reproduced acceptance of a browser-normalized ../../.. tag path. The tightened single-segment guard rejects literal/encoded dot paths and backslashes, while valid version/build-metadata tags and both real release URLs still pass. Full-pinned dispatch 35290537439 at superseded head 44576a8 was cancelled rather than reused as final-tip evidence.

Boundaries

This is project-release discovery/browser handoff, not proof of an installable Windows update. The latest stable/beta assets inspected on 2026-09-17 are macOS DMGs. No installer is downloaded or executed, no signing policy is weakened, and the parity ledger's installer/relaunch rows remain Blocked.

Selection remains bounded to the fetched 30-release page; this PR does not add pagination or change the version/channel rules. Shared Swift/macOS behavior and provider pins are unchanged.

Exact-tip hosted evidence

Final head: 1ac61a391e0df06700826e1789336d7d932ad588. All eight required checks passed:

• DCO
• Linux
• macOS
• TDD evidence
• Windows shell / UIA / packaging
• Windows port / complete validation
• Both deterministic Windows hardening contexts

Full-pinned hardening 35292975978 passed attempt 1 at that exact head after the required checks were green. The complete release gate executes the 18 updater tests. All three real-product repetitions and all seven typed resource-trend tuples pass. The gate reports 20 requests/20 responses; the real repetitions report 20/20, 19/19, and 20/20, each fully correlated with no unanswered commands. No timing, payload, resource, or correlation threshold was relaxed.

Main ancestry was freshly verified before dispatch and after completion. At superseded 44576a8, macOS attempt 1 failed during tool installation on a Zig signature-mirror HTTP 429; its isolated retry passed without code/pin changes. Final-head macOS passed attempt 1. Cancelled full-pinned run 35290537439 is not used as validation proof.

Hosted physical-tray/WSL exclusions remain explicit; native UIA and protocol-independent remote checks still run. The earlier baseline's unexplained launcher failure is not claimed fixed by this unrelated updater work.

Checklist

• DCO-signed contribution following existing native-shell patterns.
• Reproduced RED before implementing the endpoint/parser/allocation fixes.
• Focused/native shell regressions and real default WinHTTP check pass.
• Required hosted checks and exact-tip full-pinned hardening are green.