[fernandobelotto]

Adds a complete signed native update path for direct builds. Manual and automatic checks discover only stable releases with fully uploaded archive/feed/provenance artifacts; Sparkle validates the signed archive before extraction. The client checks lazily and does not download an archive until an update is offered.

Updates settings persist checking and automatic installation separately. Manual checks can focus the existing updater UI without replacing an active download bridge. Restart confirmation and lifecycle guards protect active store operations and pending data changes; deferred installation retains its callback and can be resumed from Install Downloaded Update. Credential/transport failures remain actionable.

WindowCleaner is already public and remains public. Discovery/download works anonymously; optional per-user Keychain GitHub access handles API limits.

The independent WindowCleanerAppStore target excludes Sparkle dependencies, framework linkage, updater UI and updater plist keys. Original bundle identity and entitlement behavior are preserved; sandboxed direct builds use Sparkle's documented installer permissions.

Release preparation includes unique per-app signing/public keys, a main-only protected release environment, Developer ID/notarization preparation, and staged publication with complete uploaded metadata. This PR does not publish a release, merge, or install/restart an existing app.

Validation: direct Debug and Store Release builds; Store otool/bundle/plist checks confirm no Sparkle; six independent unhosted updater tests; actual loopback/credential/metadata/redirect transport fixtures; five release policy and signature fixtures with genuine signing/mutation rejection. Updater checks have dedicated PR CI.

Follow-up hardened malformed URL/configuration failures and aligned new updater/test files with source formatting and strict lint. Focused strict updater-source lint is clean for configured lint repositories. Repository-wide legacy lint/format checks still report pre-existing source/test violations; the dedicated updater tests and transport fixtures pass locally after follow-up changes. Current remote updater CI may still be queued/running.

CI follow-up: updater sources and tests now pass the CI-matching SwiftFormat 0.63.0 checks; new long-line violations were fixed. All six isolated updater tests and transport fixtures pass locally after these corrections. Repository-wide lint/format failures include unchanged baseline source; they are not claimed green.

Final CI-version checks: exact SwiftLint 0.65.1 reports no introduced updater/test violations in repositories with lint configuration; SwiftFormat 0.63.0 checks pass. Long plain strings and raw JSON fixtures corrected; all six isolated updater tests and transport fixtures pass after these fixes. Latest-head hosted CI is pending.

Hosted CI audit: Latest broad build fails in unchanged WelcomePageView.swift:189 preview/ForEach with ChartContentBuilder availability error on the CI toolchain. That file and StoreManager are unchanged from the base; original direct target Swift5/deployment15.6 settings are preserved. Local direct and Store builds pass; hosted updater CI is pending.