feat(update): install verified macOS releases in app

.github/workflows/ci.yml

@@ -127,6 +127,11 @@ jobs:
         timeout-minutes: 20
         run: cargo test --locked --target ${{ matrix.target }}
 
+      - name: Test macOS updater
+        if: runner.os == 'macOS'
+        timeout-minutes: 10
+        run: cargo test --locked --features updater --bin tty7-updater --target ${{ matrix.target }}
+
       # There is deliberately no post-mortem step here, and that is worth
       # recording, because an earlier version of this file had one: on failure it
       # dumped the process table to find the surviving test binary.

.github/workflows/release.yml

@@ -76,7 +76,13 @@ jobs:
       # a plain checkout of the tagged commit.
       - name: Build
         working-directory: tty7
-        run: cargo build --release --locked --target ${{ matrix.target }}
+        shell: bash
+        run: |
+          cargo build --release --locked --target "${{ matrix.target }}"
+          if [[ "${{ matrix.os }}" == "macos" ]]; then
+            cargo build --release --locked --features updater \
+              --bin tty7-updater --target "${{ matrix.target }}"
+          fi
 
       # ---- Packaging: one step per OS ----------------------------------------
       # macOS gets a signed + notarized drag-to-Applications DMG. Windows gets
@@ -254,7 +260,7 @@ jobs:
   # created as a **draft** and left that way: a draft is invisible to both
   # /releases/latest and the releases page, so nothing can prompt a user to
   # download a version whose asset set is incomplete or whose notes are still
-  # empty. Publishing is the release skill's job — it verifies the six assets and
+  # empty. Publishing is the release skill's job — it verifies the platform assets and
   # writes the body first, then flips the draft. See .claude/skills/release/SKILL.md.
   draft-release:
     needs: [build, server-musl]