Phase 4a sub-commit 4: AppImageUpdate sidecar + appcast + checkForUpdates()

Wires in the option-(a) sidecar approach: the AppImage carries a
bundled AppImageUpdate AppImage and an embedded update-info string
in the .upd_info ELF section. BackendConnection drives both the
check and the apply via QProcess.

BackendConnection:
  - Q_INVOKABLE checkForUpdates()
        Bundled mode only. Spawns AppImageUpdate.AppImage with
        --check-for-update <APPIMAGE>. Exits 0 → noUpdatesAvailable,
        1 → updatesAvailable, anything else → updateCheckFailed.
        Dev mode: emits updateCheckFailed("…dev-mode only").
  - Q_INVOKABLE applyUpdate()
        Bundled mode only. Spawns AppImageUpdate.AppImage with
        --remove-old <APPIMAGE>. Replaces the running AppImage in
        place; user must restart. Emits updateApplied or
        updateApplyFailed.
  - Sidecar path resolves to applicationDirPath()/AppImageUpdate.AppImage
    by default, overridable via BRIDGE_APPIMAGEUPDATE_BIN.
  - APPIMAGE env (set by the AppImage runtime) determines the target
    file. Outside an AppImage both methods fail loudly.

build-appimage.sh:
  - Auto-downloads AppImageUpdate-x86_64.AppImage into the cached
    tools dir and copies it into AppDir/usr/bin/AppImageUpdate.AppImage.
  - New --update-info flag, forwarded to appimagetool's -u so the
    .upd_info ELF section carries an "zsync|<URL>" string the sidecar
    will fetch.

examples/todo Makefile forwards APPIMAGE_UPDATE_INFO env to the
script as --update-info.

release.yml:
  - Builds the AppImage with APPIMAGE_UPDATE_INFO set to the canonical
    Gitea Releases asset URL for this tag.
  - Installs zsync, runs zsyncmake to generate Todo-x86_64.AppImage.zsync.
  - Generates a JSON appcast (latest.json) with version / url / sha256 /
    size / zsync URL / released_at — useful as an HTTP-fetchable
    fallback for clients that prefer a structured manifest.
  - SHA256SUMS now covers AppImage + zsync + latest.json.
  - Uploads all four assets to the Gitea Release.

AppImage size grows from ~104 MB to ~152 MB with the sidecar bundled.
Embedding verified: objdump shows .upd_info populated with the
expected zsync URL after a local build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -47,19 +47,48 @@ jobs:
           make install
           make build
 
-      - name: Build AppImage
+      - name: Build AppImage (with embedded update-info)
         working-directory: examples/todo
         env:
-          # The AppImage tooling can't always FUSE-mount inside CI; use
-          # extract-and-run for linuxdeploy + manual appimagetool.
           APPIMAGE_EXTRACT_AND_RUN: '1'
           FRANKENPHP: /usr/local/bin/frankenphp
+          # AppImageUpdate sidecar will fetch this .zsync URL; it must
+          # point at the asset we're about to upload to this Release.
+          APPIMAGE_UPDATE_INFO: |
+            zsync|${{ github.server_url }}/${{ github.repository }}/releases/download/${{ github.ref_name }}/Todo-x86_64.AppImage.zsync
         run: make appimage
 
+      - name: Generate zsync metadata
+        working-directory: examples/todo/build
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y zsync
+          zsyncmake Todo-x86_64.AppImage -u Todo-x86_64.AppImage
+
+      - name: Generate latest.json appcast
+        working-directory: examples/todo/build
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          SIZE=$(stat -c %s Todo-x86_64.AppImage)
+          SHA=$(sha256sum Todo-x86_64.AppImage | awk '{print $1}')
+          URL_BASE="${{ github.server_url }}/${{ github.repository }}/releases/download/${TAG}"
+          jq -n \
+            --arg version "$TAG" \
+            --arg url     "$URL_BASE/Todo-x86_64.AppImage" \
+            --arg sha256  "$SHA" \
+            --arg zsync   "$URL_BASE/Todo-x86_64.AppImage.zsync" \
+            --argjson size "$SIZE" \
+            --arg released "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{version:$version, released_at:$released, appimage:{url:$url, sha256:$sha256, size:$size, zsync:$zsync}}' \
+            > latest.json
+          cat latest.json
+
       - name: Compute SHA256SUMS
         working-directory: examples/todo/build
         run: |
-          sha256sum Todo-x86_64.AppImage > SHA256SUMS
+          sha256sum Todo-x86_64.AppImage Todo-x86_64.AppImage.zsync latest.json \
+              > SHA256SUMS
           cat SHA256SUMS
 
       - name: Import GPG signing key
@@ -117,5 +146,7 @@ jobs:
                   --data-binary "@$f"
           }
           upload Todo-x86_64.AppImage
+          upload Todo-x86_64.AppImage.zsync
+          upload latest.json
           upload SHA256SUMS
           [ -f SHA256SUMS.asc ] && upload SHA256SUMS.asc || true