Fill the window on Linux; updates

- Linux: Tauri packs a window's webviews into one GTK box with equal
  shares and ignores their bounds, so the title bar took half the window.
  The title bar webview now has a fixed height and no share; the box's
  border is the resize frame (none when maximized).
- tauri-plugin-updater: checks llembas.eu/desktop/latest.json at start
  and every 6 h, an update button in the title bar and menu entries,
  .deb via pkexec, AppImage in place, then restart. Packages signed with
  the updater's minisign key; requireSignedVersion on.
  scripts/publish-update.sh signs a GitHub release and writes the manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ui/titlebar.css

@@ -15,8 +15,8 @@ html, body {
 
 .bar {
   display: grid;
-  /* leaf · name · host (takes the rest, and is the drag area) · agent · menu · sep · 3 controls */
-  grid-template-columns: var(--titlebar-h) auto minmax(0, 1fr) auto var(--titlebar-h) 1px repeat(3, 2.875rem);
+  /* leaf · name · host (takes the rest, and is the drag area) · update · agent · menu · sep · 3 controls */
+  grid-template-columns: var(--titlebar-h) auto minmax(0, 1fr) auto auto var(--titlebar-h) 1px repeat(3, 2.875rem);
   align-items: center;
   height: var(--titlebar-h);
   border-bottom: 1px solid var(--border);
@@ -66,6 +66,15 @@ button:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
 .bar__agent[data-state="failed"] .dot,
 .bar__agent[data-state="not_linked"] .dot { background: var(--warning); }
 
+.bar__update {
+  padding: 0 var(--sp-3);
+  color: var(--accent-ink);
+  background: var(--accent);
+}
+.bar__update:hover { color: var(--accent-ink); background: var(--accent-hover); }
+/* Hidden keeps its grid track (auto, so zero wide): the slots after it never move. */
+.bar__update[hidden] { display: block; width: 0; padding: 0; overflow: hidden; }
+
 .bar__sep { width: 1px; height: 1.25rem; background: var(--border); }
 
 .bar__btn { display: grid; place-items: center; }

ui/titlebar.html

@@ -14,6 +14,7 @@
   <span class="bar__name" data-tauri-drag-region><b>LL</b>e<b>M</b>bas</span>
   <span class="bar__host" id="host" data-tauri-drag-region></span>
 
+  <button class="bar__update" id="update" type="button" hidden>update</button>
   <button class="bar__agent" id="agent" type="button" title="Agent">
     <span class="dot" aria-hidden="true"></span><span id="agent-text">agent off</span>
   </button>

ui/titlebar.js

@@ -29,6 +29,9 @@ function render(s) {
   $("agent").dataset.state = state
   $("agent-text").textContent = WORDS[state] ?? state
   $("agent").title = state === "failed" ? `Agent stopped: ${s.agent.detail}` : "Agent"
+  $("update").hidden = !s.update
+  $("update").textContent = s.update ? `update ${s.update}` : "update"
+  $("update").title = s.update ? `LLeMbas ${s.update} is available (this is ${s.version})` : ""
 }
 
 function maximized(on) {
@@ -41,6 +44,7 @@ function maximized(on) {
 $("minimize").addEventListener("click", () => win.minimize())
 $("maximize").addEventListener("click", () => win.toggleMaximize())
 $("close").addEventListener("click", () => win.close())
+$("update").addEventListener("click", () => invoke("update_app"))
 $("menu").addEventListener("click", () => invoke("titlebar_menu"))
 $("agent").addEventListener("click", () => invoke("titlebar_menu"))