fix(updates): no install without a staged update, and a tested update flow

[thethinkmachine]

The bug

The update dialog showed Restart & Install under Up to Date, and clicking it failed with UPD-99.

.btn-p, .btn-g { display: inline-flex } outranks the user agent's [hidden] { display: none }, so updateInstall.hidden = true never hid the button. Clicking it called quitAndInstall() with nothing downloaded, and that error fell through to UPD-99.

• css/modals.css: .btn-p[hidden], .btn-g[hidden] { display: none } on the base rule; the one local copy in panels.css is gone.
• tests/hidden-markup.test.js: fails on any element index.html ships hidden whose class sets a display without a [hidden] override. Before the fix it flagged exactly #update-install.

The update flow

The main-process updater moves from electron/main.cjs to electron/updates.cjs. main.cjs keeps only loading electron-updater and the IPC channels, so tests/updates.test.js can drive the controller with a fake updater.

• Install is refused unless an update is staged. A refused or failed install is the new UPD-07 (documented). It also stops offering the restart, so the button can't retry into the same failure. UPD-99 now says "while updating", not "while checking".
• "Later" says what it does. autoInstallOnAppQuit is set deliberately rather than left at its default, and "Update Ready" says a staged update installs the next time the app is closed.
• Long sessions recheck every 6 hours. Silent, like the launch check, and skipped once an update is staged.
• Release notes. The GitHub release body is converted to plain text in the main process, capped at 4000 characters, and shown under "What's new" with textContent.
• Background download failures are visible. The menu item reads "Update Failed — Retry". A failed background check still says nothing, since being offline is ordinary.
• The rejection of downloadPromise is now handled; its error is reported once, through the 'error' event.
• The dialog's words per status live in js/update-view.js, an import-free module covered by the same tests.

Testing

• npm test: 2813 pass, 22 of them new.
• Mutation-checked: removing the CSS fix or the staged-update guard fails the tests meant to catch it.
• npm run build succeeds.
• Not yet exercised in a packaged build. Worth checking in the next release: how real release notes render, and the "Update Failed — Retry" state when a download fails.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.