Add verified automatic updates

[xptea]

Summary

• check a strict version manifest on installed interactive startup and add explicit --update/--no-update controls
• download the exact tag-specific setup asset and verify SHA-256 with Windows CNG before execution
• hand off after the monitor exits, then relaunch with the original interactive arguments
• keep JSON, one-shot, version, help, demo, redirected output, and portable auto-start paths network-free
• publish version.txt plus checksums and add a post-release live update/install/relaunch/uninstall smoke test

Security and behavior

• updates are per-user and never request elevation
• HTTPS downgrade, malformed/oversized manifests, path-like filenames, oversized installers, and checksum mismatches are rejected
• offline failures fail open into the existing monitor
• --no-update and VGPU_MON_NO_UPDATE=1 disable automatic checks

Validation

• Debug CRT leak checks and native/ConPTY/CLI tests
• optimized Release tests and PE mitigation/static-runtime verification
• MSVC AddressSanitizer
• MSVC /analyze
• package and Inno Setup creation
• installer/bootstrap checksum rejection, PATH, upgrade, and exact uninstall restoration
• release workflow includes a real post-publication GitHub update lifecycle smoke test