Self-update from published releases

[bendsp]

Implement in-app self-updates for Bedrock on macOS and Windows.

Intent

On startup, Bedrock checks once for a newer published release, downloads it in the background when found, and prompts the user to restart once the update is ready to install.

Scope

• Platforms: macOS and Windows only.
• Source of truth: the latest published GitHub release only.
• Draft releases remain part of the QA flow and must be ignored by the updater.
• Include a manual Check for Updates… command in addition to the startup check.

Functional requirements

• Add a main-process updater service around Electron’s updater flow.
• Run one silent update check per app launch.
• Allow the user to trigger a manual update check from the app UI.
• If a newer published release is available, download it in the background.
• Only prompt the user once the update is fully downloaded and ready to install.
• Restart/install should be explicit user action, not forced immediately.
• Capture updater failures in telemetry.
• For manual checks, surface either no update available or an actionable error.
• For startup checks, stay quiet unless an update becomes ready to install.

Public interfaces

• Add shared updater state/types to the IPC contract.
• Expose preload bridge methods for:
  • checking for updates
  • subscribing to updater status
  • installing a downloaded update
• Renderer should be able to observe updater states:
  • idle
  • checking
  • available/downloading
  • ready
  • error

Acceptance criteria

• A newer published release is detected on startup without user action.
• Draft GitHub releases do not appear as installable updates.
• Manual Check for Updates… works even if startup check already ran.
• When an update is found, Bedrock downloads it in the background and prompts only after it is ready.
• User can choose to restart and install from the prompt.
• Updater errors are captured in telemetry and surfaced only when appropriate.
• Release docs clearly state that self-update targets published releases, while drafts remain QA-only.

Test plan

• Unit-test updater state transitions and IPC event mapping.
• Add a deterministic test seam so E2E can simulate updater events without network access.
• Manual QA on macOS and Windows:
  • no update available
  • published update available
  • update downloaded and ready prompt
  • restart/install flow
  • draft release ignored

Out of scope

• Linux update delivery
• Periodic background polling after startup
• In-app release channel switching
• Any updater behavior that relies on draft releases