fix(windows): self-update runs no PowerShell and installs only files signed like the launcher

On Windows the launcher finished its own update with a detached
powershell.exe started with -ExecutionPolicy Bypass -WindowStyle Hidden.
The script waited for the launcher to exit, ran the new MSI or unpacked
the portable zip with Expand-Archive, deleted the download and started the
new exe. Antivirus heuristics score that sequence, and the command line
sits in the signed exe as a string.

The update helper is now a copy of the launcher itself, put in
<cache>\launcher-update-helper and started with --finish-update. It waits
for the old process with OpenProcess and WaitForSingleObject (winsafe),
runs msiexec /i /passive /norestart and checks its exit code, or unpacks
the portable zip with the checks portable app installs already use, and
then starts the launcher again. main() hands --finish-update to the helper
before logging, the single-instance claim and the window.

The helper finishes only the launcher's own update:
- the exe is this launcher's MSI or portable installation, and the
  helper, the download and the staging folder are in that installation's
  cache;
- the MSI, every program in the portable zip and the exe it starts carry
  a valid Authenticode signature from the helper's own publisher
  (verifysign, through WinTrust).
The launcher checks its own signature, the installed exe and the new MSI
before it quits, so an unsigned build reports that it doesn't install
updates instead of closing. A failed update clears the self-update marker,
so the next check offers it again, and the next start logs the error.

Cargo.lock

@@ -324,7 +324,9 @@ dependencies = [
  "tar",
  "tempfile",
  "ureq",
+ "verifysign",
  "winreg",
+ "winsafe",
  "zip",
 ]
 
@@ -4989,6 +4991,16 @@ dependencies = [
  "vello_common",
 ]
 
+[[package]]
+name = "verifysign"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6acfcc42a8d44f340d001193d97ef56bf33210b51ad760ae8308c97d5241ca51"
+dependencies = [
+ "core-foundation 0.10.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
@@ -5781,6 +5793,12 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "winsafe"
+version = "0.0.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef0ffc427f045c0cc9ebffd6f4f91153dcd2a1547b5c3c29ee3f541e16e95c6"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"