Show Mac app version and add opt-in release checks

[MatthewFeroz]

Users cannot currently check for newer Mac app releases from Try Omarchy, and guest package versions do not identify the installed host app. This adds a version label and Check for Updates… to the start menu and native application menu, plus an update window with an opt-in daily startup check and a link to release notes/downloads.

This implements the version-tracking and release-notification stage of #232. It does not close that issue: signed in-app installation remains a separate Sparkle integration, described in docs/app-updates.md.

Behavior:

• Compare stable vX.Y.Z releases numerically and require an uploaded TryOmarchy.dmg. Never offer the same or an older version as an update.
• Trust the installed release only when TryOmarchyBuildDescribe matches CFBundleShortVersionString. This uses the metadata proposed in fix(macos): stamp app version from git release tag #223 without duplicating that PR. Legacy bundles with misleading hardcoded metadata display an unknown release; development builds retain their build description. Merge fix(macos): stamp app version from git release tag #223 to enable accurate release identification in shipped builds.
• Automatic checks default off and run asynchronously at most once per 24 hours when the app opens. Manual checks work independently. Errors leave launch available, and automatic results update the launcher link without opening a dialog over the guest. Cache the discovered version to retain the indicator across launches.
• Open the project's release page for manual installation and OS requirements. No updater code shuts down QEMU, downloads app binaries, replaces the app, or modifies guest data. GitHub's release response has no structured minimum macOS version, so this stage does not claim installation compatibility.

The recommended next stage uses Sparkle 2, a maintainer-owned HTTPS appcast and Ed25519 key, monotonic build numbers, and installation gated on confirmed VM/recovery shutdown. The current application quit path sends SIGTERM and must not be treated as a clean guest-shutdown guarantee.

Validation:

• Added eight release-check tests covering release metadata, numeric comparisons, downgrade avoidance, legacy/development identity, scheduling, manual checks, concurrent request coalescing, cached results, offline retries, HTTP errors, and malformed responses. Native menu coverage verifies the update action and target.
• Local guest contracts pass. Local make test reaches the same six pre-existing Linux boot-export/authentication failures previously reproduced on unchanged main (58cbac5).
• The complete make test suite passed on the existing macOS 15 CI runner for commit 9f1c6ea, including all eight new release-check tests and the native application-menu test: https://github.com/MatthewFeroz/try-omarchy/actions/runs/35389964136
• No signed app/DMG build or interactive Mac smoke test was performed on this Linux host. No build-input pins or dependencies changed.