🔒 [security] Validate code signature on auto-update

[hatimhtm]

🎯 What:
The application's auto-update mechanism previously downloaded a DMG, mounted it, and blindly copied the updated application bundle into /Applications/Click2Minimize.app without performing any verification.

⚠️ Risk:
This behavior exposed users to significant security risks. Because the update mechanism did not verify the application's integrity or signature before installation, it was vulnerable to Man-in-the-Middle (MITM) attacks during the download process (if TLS was compromised or bypassed) or malicious modification of the downloaded file locally. If an attacker could replace the legitimate .dmg with a tampered version, the application would automatically install and prompt the user to run the malicious payload with the application's inherited permissions. Additionally, the previous implementation hardcoded the volume mount point, which is susceptible to path hijacking/TOCTOU if a malicious actor pre-created the volume path.

🛡️ Solution:

1. Dynamic Mount Point Resolution: Instead of relying on a hardcoded string (/Volumes/Click2Minimize), the hdiutil attach command now uses the -plist flag. The downloadDMG method parses the XML output using PropertyListSerialization to dynamically identify the exact mount-point allocated by the system, mitigating path prediction vulnerabilities.
2. Code Signature Validation: Prior to copying the updated application into /Applications, the implementation now invokes /usr/bin/codesign --verify -v <app_source_path>. The copy operation only proceeds if codesign exits with a status of 0, confirming the application's signature is valid and intact. If verification fails, the update process is cleanly aborted and the user is redirected to the manual download page.
3. Pipe Deadlock Prevention: Safely reads the hdiutil -plist output asynchronously using readabilityHandler instead of a synchronous blocking read inside the terminationHandler to avoid a common deadlock pattern when standard output exceeds pipe buffer limits.

---

PR created automatically by Jules for task 15054131464811650009 started by @hatimhtm

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.