fix(updater): use public release sources

[xjdr-noumena]

Summary

Fixes the public native updater source for #46.

• removes Artifactory/native npm package lookup from the native installer update path
• defaults native update version checks and downloads to GitHub Releases
• keeps NCODE_NATIVE_PACKAGE_URL / MACRO.NATIVE_PACKAGE_URL as the explicit binary-repo override for public GCS or internal-only buckets
• removes the old hardcoded Claude GCS bucket from package-manager update checks
• keeps the existing binary-repo layout for configured buckets
• adds tests for GitHub Releases default, binary repo override, zip checksum verification, missing/mismatched assets, and package-manager update source selection

Internal deployments should set NCODE_NATIVE_PACKAGE_URL to their internal bucket. There is no internal Artifactory fallback.

Validation

Focused updater/native installer tests:

PATH="$HOME/.bun/bin:$PATH" timeout 60s $HOME/.bun/bin/bun test \
  src/utils/nativeInstaller/download.test.ts \
  src/utils/autoUpdater.publicSource.test.ts \
  src/utils/nativeInstaller/packageManagers.test.ts

Result: 6 pass, 0 fail for the two new/changed test files; packageManagers.test.ts is absent in this checkout.

Contracts:

PATH="$HOME/.bun/bin:$PATH" timeout 120s $HOME/.bun/bin/bun run test:contracts

Result: 238 pass, 0 fail.

Package smoke:

PATH="$HOME/.bun/bin:$PATH" timeout 180s $HOME/.bun/bin/bun run test:package-smoke

Result: passed. Security audit OK; native probe OK with documented sharp-fallback image mode.

Diff check:

git diff --check

Result: passed.

Updater residue check:

rg -n "artifactory|Artifactory|ARTIFACTORY|claude-code-dist|undefined@latest|npm view undefined|MACRO.NATIVE_PACKAGE_URL}@|NATIVE_PACKAGE_URL}@" \
  src/utils/nativeInstaller src/utils/autoUpdater.ts src/components/PackageManagerAutoUpdater.tsx src/components/AutoUpdater.tsx src/cli/update.ts build .github README.md OSS_BUILD.md package.json

Result: no matches in the targeted updater surfaces.

Closes #46.