feat(desktop): restart to update when threads finish

[CopyJosh]

Desktop users can schedule a downloaded update to restart after threads finish, with a clock badge on the existing update icon in both sidebar layouts. Clicking the icon cancels the scheduled restart; Settings also offers cancellation.

Before installation, each enabled environment checks its authoritative thread state and drains provider commands, message ingestion, and checkpoint work. Remote-only desktop mode is supported. Installation is pinned to the selected version; a competing update check returns the scheduler to waiting so readiness is checked again. Native installer errors remain observed after acceptance and allow retry.

Related: pingdotgg/t3code#9286

Validation

• 76 focused tests passed across the native updater, server readiness, client readiness, restart controller, and update UI logic.
• The authenticated WebSocket readiness integration test passed.
• Regression coverage includes deferred message/checkpoint completion, remote-only mode, cancellation during preparation, late native installer failure, changed downloads, and concurrent update checks.
• Web typecheck passed. Targeted lint passed with existing warnings in the server test file.
• Server and desktop typechecks remain blocked by errors in unchanged HostPowerMonitor.ts, NativeTelemetryClient.ts, and ChromiumCookies.ts.
• The original reviewers rechecked their findings and confirmed the fixes.
• The isolated desktop preview was launched with a simulated update. The persistent restart bar is replaced by a clock badge; 18 focused update tests and the web typecheck passed after this change. Screenshot upload remains pending because browser file-upload permission is unavailable.

Review base

Targets codex/upstream-base-9375c7797, the upstream main commit this feature started from. The fork's main and thread-fork branches are unchanged. Remains a draft pending visual validation.

Implemented with GPT-6 in the Codex desktop app.