Restore update-flow coverage as a v6 Playwright spec, retire test-updates workflow

The Update Integration Tests workflow lost its Go test
(tests/integration/api) in the v6 release commit and was reduced to a
diagnostic smoke test that duplicated the test-e2e stack boot. Replace
it with tests/79-update-flow.spec.ts in the main suite, which runs via
test-e2e.yml on the same trigger paths:

- stable-channel check returns the mock v99.0.0 release and filters
  the v99.1.0-rc.1 prerelease (regression guard for the auto-update
  prerelease bug); rc-channel check surfaces the prerelease
- update plan reports honest manual instructions for the docker
  deployment with readiness attached
- apply refuses prerelease download URLs on the stable channel (409)
- apply of an unsigned artifact fails closed at SSHSIG verification;
  a completed update against the unsigned mock artifact would mean
  the pinned-key trust root was bypassed

The old happy-path apply test is intentionally not revived: v6 made
SSHSIG verification against the pinned pulse-installer key mandatory,
so completing an apply would require shipping the real signing key to
the harness or weakening the trust root.

mock-github-server now serves v-prefixed asset names and download
paths like real Pulse releases (pulse-v99.0.0-linux-amd64.tar.gz);
the in-app updater only recognizes v-prefixed versions in download
URLs, so the old unprefixed shape made every apply fail validation
before reaching the paths under test. Unknown non-tarball sidecar
files (e.g. .sshsig) now 404 instead of falling back to tarball bytes.

The spec self-skips when the update check is not served by the mock
server, so managed-local-backend runs are unaffected.

.github/workflows/test-updates.yml

@@ -1,126 +0,0 @@
-name: Update Integration Tests
-
-on:
-  pull_request:
-    paths:
-      # Trigger on changes to update-related code
-      - 'internal/updates/**'
-      - 'internal/api/updates.go'
-      - 'internal/api/rate_limit*.go'
-      - 'frontend-modern/src/components/Update*.tsx'
-      - 'frontend-modern/src/api/updates.ts'
-      - 'frontend-modern/src/stores/updates.ts'
-      - 'tests/integration/**'
-      - '.github/workflows/test-updates.yml'
-  push:
-    branches:
-      - main
-      - master
-    paths:
-      - 'internal/updates/**'
-      - 'internal/api/updates.go'
-      - 'frontend-modern/src/components/Update*.tsx'
-      - 'tests/integration/**'
-  workflow_dispatch: # Allow manual triggering
-
-
-
-permissions:
-  contents: read
-
-jobs:
-  integration-tests:
-    name: Update Flow Integration Tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: tests/integration/package-lock.json
-
-      - name: Install Playwright dependencies
-        working-directory: tests/integration
-        run: |
-          npm ci
-          npx playwright install --with-deps chromium
-
-      - name: Install frontend dependencies
-        working-directory: frontend-modern
-        run: npm ci
-
-      - name: Build Pulse for testing
-        run: |
-          make build || go build -o pulse ./cmd/pulse
-
-      - name: Build Docker images for test environment
-        working-directory: tests/integration
-        run: |
-          # Build mock GitHub server
-          docker build -t pulse-mock-github:test ./mock-github-server
-
-          # Build Pulse test image
-          cd ../../
-          docker build -t pulse:test --target runtime .
-
-      - name: Run diagnostic smoke test
-        working-directory: tests/integration
-        env:
-          MOCK_CHECKSUM_ERROR: "false"
-          MOCK_NETWORK_ERROR: "false"
-          MOCK_RATE_LIMIT: "false"
-          MOCK_STALE_RELEASE: "false"
-          # The diagnostic spec skips itself unless explicitly enabled.
-          PULSE_E2E_DIAGNOSTIC: "1"
-        run: |
-          docker compose -f docker-compose.test.yml up -d --wait
-          npx playwright test tests/00-diagnostic.spec.ts --reporter=list,html
-          docker compose -f docker-compose.test.yml down -v
-
-      - name: Upload test results
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-report
-          path: tests/integration/playwright-report/
-          retention-days: 30
-
-      - name: Upload test videos and screenshots
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: test-failures
-          path: |
-            tests/integration/test-results/
-          retention-days: 7
-
-      - name: Cleanup Docker resources
-        if: always()
-        working-directory: tests/integration
-        run: |
-          docker compose -f docker-compose.test.yml down -v || true
-          docker system prune -f || true
-
-      - name: Comment PR with test results
-        if: github.event_name == 'pull_request' && failure()
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
-        with:
-          script: |
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: '❌ Update integration tests failed. Please check the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.'
-            })