feat(sparkle): add in-app updates using Sparkle framework

[jsattler]

Summary

Integrates Sparkle 2 for in-app update support, closing #36.

• Add Sparkle as an SPM dependency with UpdaterService wrapper for SwiftUI
• Wire up "Check for Update" button and auto-check toggle in Settings to Sparkle's updater
• Update release workflow to sign DMGs with Sparkle EdDSA and upload appcast.xml as a release asset
• Add appcast generation script that embeds GitHub release notes as inline HTML
• Update sandbox entitlements for Sparkle (network client + Mach lookup exceptions)
• Update Homebrew cask to use livecheck with strategy :github_latest (no more CI commits)

Appcast hosting

The appcast is uploaded as a GitHub release asset. Sparkle clients fetch it from:

https://github.com/jsattler/BetterCapture/releases/latest/download/appcast.xml

This URL always resolves to the latest non-prerelease, so no manual URL management is needed.

Required secrets

Before the first release with Sparkle, two GitHub Actions secrets must be created:

Secret	Description
SPARKLE_PUBLIC_EDDSA_KEY	EdDSA public key (injected into Info.plist at build time)
SPARKLE_PRIVATE_EDDSA_KEY	EdDSA private key (signs the DMG for update verification)

Generate with ./bin/generate_keys from the Sparkle distribution.

Release workflow changes

The release workflow no longer commits anything back to the repository. Instead:

• appcast.xml is uploaded as a release asset alongside the DMG
• Homebrew cask uses sha256 :no_check and livecheck - version is updated manually before release

Closes #36