Polish update widget and checksum metadata

[kabudu]

Summary

• Replace the full-width admin update banner with a compact TokenScavenger-orange header widget beside the health pill.
• Keep the update CTA visible but visually aligned with the Operational status pill.
• Change release checksum generation to emit bare asset filenames so v0.3.5 self-update clients can verify newer releases.

Why

The update bar was visually too heavy, and v0.3.5 self-update fails against releases whose checksums.txt only lists dist/... paths.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features
• cargo test --all-features
• Local shell check of the release checksum generation command confirms basename-only entries.
• Browser preview verified the orange header widget using the real update-check path.

Notes

No .dev files are included.