feat(update): Add verified standalone Craft self-update

[MathurAditya724]

craft update [releaseVersion] updates standalone Craft to the latest stable or an explicit published release. Pinned binpatch 0.4.2 discovers stable delta chains when available and smaller than a full download; Craft validates patch bounds and the resulting target digest before signature/version checks and replacement. Unusable patches fall back to the canonical HTTPS binary download. Explicit prereleases use full downloads.

Both build workflows generate optional patches with the pinned BYK/binpatch action against the previous stable release. Raw Unix assets supply GitHub target digests; gzip assets supply patch source/size inputs, including Windows EXE gzip. These sources are required before publishing; patches remain optional. Published checksum sidecars and full-download checksum requests have been removed following review. Binpatch's target digest remains necessary to reject incompatible patch output.

--check and dry-run fetch metadata only; --force permits reinstalls/downgrades. npm/pnpm and Homebrew installations receive package-manager instructions. The placement lock rejects concurrent replacement during download. Windows restores its backup if final rename fails and reports backups that remain in use.

Review-requested cleanup removes updater-smoke.mjs and the native-image delta roundtrip test, along with their dedicated CI setup. Binpatch owns patch algorithm coverage. Focused tests retain Craft-specific release selection, URL/download/output bounds, malformed-patch preflight, fallback, version checks, dry-run, placement rollback, and concurrent-replacement guards. Local focused tests, types, and lint pass.

Stacked on #906. Ready for review.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-15 18:45 UTC

[BYK]

We should be using binpatch like the CLI does for patch updates

[MathurAditya724]

Addressed the binpatch request in c53a109, propagated through #908 and #909. Both build workflows generate optional stable-release patches using the same pinned binpatch action revision as Sentry CLI. The updater discovers stable chains, bounds download/decompression/application sizes, verifies the resulting target digest, then performs the existing signature/version checks and atomic replacement. Missing or unusable patches fall back to the verified full download; explicit prereleases use full downloads.

Independent review also caught an upstream malformed-control overrun. Craft now validates all decoded blocks and control lengths before applying in memory, and keeps writes inside its dry-run-aware staging abstraction. Reproducing regression tests now pass. The native artifact test runs an actual stable-image delta update without downloading the full image, then verifies corrupt-patch fallback.

All current-head checks on this draft pass, including Node 22/24, docs/container builds, and macOS ARM64 installer/updater/delta execution. The same artifact test runs across macOS/Linux ARM64/x64 and Windows x64 in #908/#909. Please re-review the updater changes; all PRs remain drafts.