Bundle the macOS CLI and support updates without the app window

[mahype]

When TorroMail cannot reopen its window, users lose access to the app's update controls (as in v0.10.3). The macOS bundle now includes the existing torromail CLI and a separate Sparkle updater, so /Applications/TorroMail.app/Contents/MacOS/torromail update can install an update without that window. update --check only probes; --interactive permits an installation authorization prompt when needed.

The helper compiles Sparkle's official CLI drivers from the same pinned SwiftPM checkout as the embedded framework and uses the target app's feed and Ed25519 public key. It rejects disabled development builds, unrelated apps and invalid update configuration. The command runs before account state or keychain initialization and detects relocated bundles and symlinked CLI paths. Linux/Windows retain their existing package/release update path.

Both dev and universal release builds bundle and explicitly sign the CLI/helper. The internal GUI executable is renamed to TorroMailApp to avoid colliding with torromail on case-insensitive volumes. Release smoke checks verify helper signatures, signing teams, linkage and architectures; documentation includes the recovery command and the one-time manual upgrade needed for older apps.

Validation:

• cargo test and cargo build -p torromail-mcp passed.
• Swift contract suite and app build passed.
• Universal release bundle built and passed deep signature verification (local ad-hoc build; production notarization remains in the release workflow).
• Local signed-update integration test passed against both dev and release bundles: check-only/current, invalid-signature rejection, closed-app replacement, termination/relaunch of a running windowless app, relocated/symlinked paths, and invalid/missing app configuration. It uses disposable fixtures and an ephemeral signing key without changing the installed app or mail data.
• macOS CI now runs the integration test.

Closes #55. Target: next release after v0.10.5.