Detect damaged or partially updated installations on startup #1059

Problem

An update or install can finish with some files replaced and others not. One observed case on Windows:
Avast CyberCapture held %LOCALAPPDATA%\Macro Deck\uninstall.exe for scanning ("suspicious file
detected") during an update. Afterwards the web client showed "This page is out of date" and could not
recover, which fits a host binary and its served UI files (wwwroot) coming from different builds.

Nothing today detects a partial or damaged installation. The symptoms show up far away from the cause:
a web client or desktop UI that reports a version mismatch, a plugin runtime that fails to load, or a
host that crashes on startup. The user gets no hint that reinstalling would fix it.

Proposal

1. Manifest at build time. CI writes a file manifest for every packaged platform: relative path,
   size and SHA-256 of each file the installer lays down, plus the app version and commit. It ships
   inside the package, and it is signed or covered by the existing code signature so it cannot be edited
   to match tampered files.
2. Check on startup. The bootstrapper or the host verifies the installation against the manifest.
   This runs early and without blocking the window, and caches results by file size and mtime so a normal
   start does not hash hundreds of megabytes.
   • Missing or mismatched files are logged with their paths.
   • Files that are only allowed to differ (user data, logs, plugin folders, anything outside the install
     directory) are excluded.
3. Tell the user. A localized notice in the desktop app says that Macro Deck is damaged or was not
   updated completely, names the likely cause (an interrupted update or antivirus software holding
   files), and offers:
   • reinstalling the current version (download link or the updater's install flow);
   • a link to the troubleshooting guide.
4. Optional repair. Download the signed release payload for the installed version through the
   existing updater channel, verify its signature, and reapply it (or run the installer silently).
   Needs care:
   • it must reuse the updater's signature verification, never download unsigned content;
   • it must not loop if antivirus software blocks the same file again;
   • Linux packages are managed by apt/AUR/AppImage, where the notice should point at the package
     manager instead.

Related

The web client and desktop UI version-mismatch screen is being reworked separately. It will tell the
user when the UI files served by Macro Deck do not match the installed version. That covers the
symptom in the client; this issue is about detecting and fixing the cause on the computer.

Open questions

• Which component owns the check (bootstrapper, before starting the host, or the host itself)?
• How are the manifest and its signature produced for signed Windows builds, notarized macOS bundles
  and the Linux packages?
• Does a repair reuse the updater (ui/bootstrapper/src/updater.rs) or a dedicated path?
• What is excluded from the manifest (plugins, dotnet runtime staging, generated caches)?