feat(berd-call): bundle CLI with Berd and check updates on call start

[johnmatthewtennant]

Summary

Why

A separately installed Berd Call CLI would not reliably track Berd app updates. Starting a call should also be able to discover a newer Berd release without replacing the app while the call is using its bundled binary.

What

Berd now bundles the macOS berd-call CLI, and a call started from that bundle triggers a background app update check. A shared lock permits download during the call but defers app-bundle installation until the call ends. Standalone developer builds neither trigger nor block Berd app updates.

The README explains installation through Berd and a stable PATH symlink. Release archives exclude macOS AppleDouble entries so the updater can unpack them.

just install-berd-call-dev builds and installs a development CLI in a stable user-local location and links ~/.local/bin/berd-call to it. just uninstall-berd-call-dev restores the link to the installed Berd app CLI when available, otherwise removes the development command. The installer preserves unrelated existing commands.

Related issue

None found.

Testing

End-to-end in an isolated, signed 0.6.5 to 0.6.6 update rehearsal:

1. Start a real microphone-backed call with the CLI bundled in the 0.6.5 app, using an update feed offering a signed 0.6.6 archive.
2. While the call is active, confirm the manifest and archive are fetched, the update is pending, and the running app remains 0.6.5.
3. Stop the call and confirm the pending update installs 0.6.6. Verify the updated app signature, run its bundled CLI, and compare that CLI to the packaged 0.6.6 binary.

All three steps passed. The rehearsal used isolated bundles and a local signed feed; it did not modify the installed production Berd app.

Development installation was exercised in isolated directories, including uninstall with no released CLI installed and refusal to replace an unrelated command. The real just install-berd-call-dev command also passed: berd-call resolved from PATH, help and version ran, and the installed binary matched the newly built binary.