fix: defer Windows updater swap until exit

[Smugcurve13]

Summary

• stage the replacement executable and swap it only after the running app exits
• relaunch the existing app after a successful swap or any swap/rollback failure
• add updater regression coverage and run it in both build workflows
• bump the hotfix version to 1.2.2

Validation

• uv run --python 3.12 --with certifi python tests/test_updater.py (2 passed)
• git diff --check origin/main...HEAD

Platform note

The delayed swap behavior needs final installer/relaunch validation on Windows.