fix(desktop): retry update downloads without rechecking feed

[jackwener]

Summary

• Retry a failed background asset download once after a short delay, without repeating the GitHub release-feed request.
• Make manual download retry reuse electron-updater's already discovered update and route the About-page action to that retry path.
• Keep provenance verification and install gating in place; add bounded diagnostic messages and regression coverage for retry success, final failure, and Nightly versions.

Verification

• npm --workspace @maka/desktop run build
• npx tsc -p apps/desktop/tsconfig.renderer.json --noEmit
• 47 focused App Update tests passed, including service, UI projection, boundary, and attestation tests.
• Signed local macOS package E2E passed: 0.2.0 -> 0.2.1 through a loopback update feed, Squirrel.Mac replacement, and automatic relaunch.

The loopback E2E deliberately bypasses remote Sigstore provenance; the attestation verifier has separate tests. No release has been published.