Update: check, verify and stage releases in a new fieldcraft-update crate (#231)

Versions ordered as SemVer, the GitHub Releases API reply read as hostile input, how this
copy is installed (macOS app or CLI, Windows folder, AppImage, tar.gz folder, .deb/.rpm) and
which release asset updates it, the checksum list's minisign signature checked against the
built-in release key, the asset's SHA-256 checked against the list, archives unpacked inside
the staging folder, and the swap planned and applied by renames with undo on failure. The
network and unpacking parts are native only; a mock release server drives the tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

crates/update/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "fieldcraft-update"
+description = "FieldCraft's updates: check GitHub Releases for a newer version, download and verify it (SHA-256 list signed with the release key), and swap it in"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[features]
+# A local HTTP server that plays the GitHub Releases API, for tests (`mock`).
+mock = []
+
+[dependencies]
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+log = { workspace = true }
+sha2 = { workspace = true }
+# Checks the release key's signature of SHA256SUMS.txt (Ed25519, minisign's format). MIT.
+minisign-verify = "0.3"
+
+# Downloading and unpacking: the desktop app and the CLI only, never the browser build.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# HTTPS with rustls on ring, checked against the operating system's certificates: the same
+# client the app's usage sending uses (apps/fieldcraft).
+ureq = { version = "3.4", default-features = false, features = ["rustls-no-provider", "platform-verifier"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+zip = { workspace = true }
+flate2 = "1"
+tar = { version = "0.4", default-features = false }
+
+[dev-dependencies]
+# Signs test checksum lists with throwaway keys (never the release key).
+minisign = "0.9"