Prepare 0.2.7 with actionable Insights and secure in-app updates

[thrr87]

Summary

• Make Codex-assisted Insights reliable, scoped to the selected evidence, and actionable instead of restating Graphs and Facts.
• Disable every Codex CLI feature for the isolated analysis task, including future feature names, while failing closed on malformed discovery.
• Add a protected manual Release workflow that validates a stable version, builds one universal macOS app, signs the Sparkle archive and feed with EdDSA, and creates a Draft Release only.
• Add an accessible Upgrade button backed by Sparkle. It appears only for a newer published stable release, shows version and release notes, verifies the signed update, installs it, and relaunches the app.
• Add a local signed-feed QA flow and release runbook. Existing installations still need one manual update before in-app updates become available.

Verification

• 564 Swift tests pass.
• Release version self-test and 0.2.7 validation pass.
• Universal release build contains x86_64 and arm64; strict deep code-signature validation passes.
• Locally generated production-style appcast and archive pass EdDSA signing and verification.
• Computer Use QA completed the full 0.2.6 → 0.2.7 flow: availability, release notes, close/reopen, download, signature verification, install, relaunch, and removal of the Upgrade button on the current version.
• Shell syntax, plist, workflow YAML, XML, and diff checks pass.

No 0.2.7 release, tag, or draft is created by this PR.

Closes #61
Closes #62
Closes #63
Closes #65
Closes #66