tests: raise updater coverage from 68.8% to 86.6%

[TeoSlayer]

Summary

• Adds two new *_test.go files (no production code modified)
• Lifts package coverage from 68.8% → 86.6% (above the 85% target)
• Closes branches in checkOnce, fetchLatestRelease, applyUpdate, downloadFile, VerifyChecksum, extractTarGz, replaceBinary, checkLoop, and the OS-dispatched signalDaemonRestart* helpers
• Pins the security-critical "refuse install when checksums.txt is missing" + "fail if checksums download errors" paths (already had golden-path tests; this adds negative paths through applyUpdate, plus a corrupt-archive-with-valid-hash case)

Approach

• All network mocked via httptest.NewServer — no calls to github.com
• fetchLatestRelease hardcodes https://api.github.com/..., so tests inject an http.RoundTripper that rewrites scheme+host onto the test server. Lets us drive the full checkOnce path without modifying production code
• Uses t.TempDir() everywhere; race detector clean

Coverage breakdown (after)

function	before	after
checkOnce	13.0%	100.0%
fetchLatestRelease	44.4%	94.4%
checkLoop	42.9%	92.9%
downloadFile	83.3%	100.0%
signalDaemonRestartLinux	0.0%	26.3%
applyUpdate	81.5%	88.9%
extractTarGz	86.2%	93.1%
VerifyChecksum	88.0%	96.0%
total	68.8%	86.6%

Test plan

• go test -race -count=1 -timeout 120s ./... passes
• go test -cover ./... reports >= 85%
• No real network calls (httptest only)
• No production code modified

Out of scope (iter-1 audit gaps, unchanged)

• No Cosign/minisign binary signature verification yet (task #63)
• No TLS pinning on api.github.com
• These remain follow-up work; this PR just raises confidence in the existing checksum-only path

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️