Fill the window on Linux; updates

- Linux: Tauri packs a window's webviews into one GTK box with equal
  shares and ignores their bounds, so the title bar took half the window.
  The title bar webview now has a fixed height and no share; the box's
  border is the resize frame (none when maximized).
- tauri-plugin-updater: checks llembas.eu/desktop/latest.json at start
  and every 6 h, an update button in the title bar and menu entries,
  .deb via pkexec, AppImage in place, then restart. Packages signed with
  the updater's minisign key; requireSignedVersion on.
  scripts/publish-update.sh signs a GitHub release and writes the manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ui/titlebar.js

@@ -29,6 +29,9 @@ function render(s) {
   $("agent").dataset.state = state
   $("agent-text").textContent = WORDS[state] ?? state
   $("agent").title = state === "failed" ? `Agent stopped: ${s.agent.detail}` : "Agent"
+  $("update").hidden = !s.update
+  $("update").textContent = s.update ? `update ${s.update}` : "update"
+  $("update").title = s.update ? `LLeMbas ${s.update} is available (this is ${s.version})` : ""
 }
 
 function maximized(on) {
@@ -41,6 +44,7 @@ function maximized(on) {
 $("minimize").addEventListener("click", () => win.minimize())
 $("maximize").addEventListener("click", () => win.toggleMaximize())
 $("close").addEventListener("click", () => win.close())
+$("update").addEventListener("click", () => invoke("update_app"))
 $("menu").addEventListener("click", () => invoke("titlebar_menu"))
 $("agent").addEventListener("click", () => invoke("titlebar_menu"))