Add update checks and in-place auto-update from GitHub Releases

[tsvb]

Summary

Built-in update checks and auto-update with no third-party code: the feed is this repo's GitHub Releases, the install is a signature-verified swap of the bundle.

• Check. Once a day at launch, quietly: it only speaks when something is newer than the running version and not a version the user skipped, and it swallows network errors. LUTzy ▸ Check for Updates… (and Settings ▸ Check Now) always reports: newer, up to date, or the error.
• Install and Relaunch. Downloads the DMG, mounts it read-only, and verifies the app inside against a SecRequirement derived from the running copy: Apple-anchored Developer ID chain, same Team ID, same bundle identifier, strict and nested. Then copies it next to the current app, swaps with two renames, removes the old bundle, detaches, and hands open to a shell that waits for this process to exit before relaunching.
• What a dev build does. swift run has no Info.plist, so no version: the automatic check never runs, and a manual check offers the release page instead of an install. An unsigned bundle is refused the same way.
• Settings. An Updates section with the automatic-check toggle, the current version, and Check Now. Skip This Version lives on the sheet.
• Release convention (README): tag vX.Y.Z with the DMG attached, which is what v0.1.0 already is.

Verification

• swift test: 356 tests, 0 failures. UpdateTests covers version parsing and ordering, feed decoding (with and without a DMG, bad tag), both check manners, skipped versions, the 24h interval, the preference, install failure surfacing, and the on-disk swap including a read-only destination.
• The requirement string was run by hand with codesign --verify -R= against the app inside the published LUTzy-0.1.0.dmg: it passes, and a wrong Team ID fails.
• End-to-end runs on 2026-09-13. v0.1.1 was built with scripts/release-dmg.sh from this branch, notarized, and published. A copy of the same build stamped 0.1.0 and re-signed was installed in /Applications; on launch the daily check found 0.1.1 and put up the sheet; Install and Relaunch downloaded, verified, and swapped the bundle (/Applications/LUTzy.app at 0.1.1, signature valid, nothing mounted, no staged/retired bundle or temp directory left). First run: the old process did not quit — NSApp.terminate under the presented sheet was ignored — and the relaunch helper sat waiting; ending the process by hand made it open the new build. Fixed in the second commit (sheet down first, hard exit if terminate is ignored). Second and third runs, from a 0.1.0 stand-in built from the fixed source (LUTZY_SKIP_NOTARIZE=1), read through the new os.Logger stream: check → available → Install and Relaunch → downloaded, mounted, signature verified, swapped, helper started, process gone within a second, new process up as 0.1.1. No mount, no staged or retired bundle, no temp directory left.

Test plan

• Release 0.1.1 with scripts/release-dmg.sh 0.1.1 and publish it as v0.1.1 with the DMG.
• Launch the installed 0.1.0 (this branch built into it), open LUTzy ▸ Check for Updates…, click Install and Relaunch. Expect the app to relaunch as 0.1.1 with no Gatekeeper prompt.
• Check again: "LUTzy is up to date". (Not driven from here: accessibility cannot invoke the menu item or read the SwiftUI sheet; one manual check on the installed 0.1.1 is the remaining hand step.)
• v0.1.1 asset rebuilt from the final branch, notarized, and replaced (23:48 UTC). A fourth run from a 0.1.0 stand-in installed that published asset: swapped, relaunched as 0.1.1 within four seconds of the click, stapled ticket validates, nothing left behind.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ViSYWttguWwFQm1PEksQ7K