Adds `lem update` (+ --check, --channel override), using dappco.re/go/update
v0.13.0's primitives. The default channel is derived from the running
binary's own stamped version (deriveUpdateChannel): a v1.2.3 build follows
stable, v1.2.3-beta.1 follows beta, v1.2.3-alpha.2 follows alpha, and a
dev-<sha12> build follows the rolling dev prerelease — release channels as
a side effect of the version string, not a separately tracked setting.

Asset self-selection (selectReleaseAsset/updateAssetPrefix) replaces
go-update's GetDownloadURL: this repo's asset names spell os/arch as
macos/x86_64/aarch64, which never match runtime.GOOS/GOARCH substrings
(darwin never appears in a macos-* name), so lem maps the dimensions itself
and exact-prefix-matches against release.Assets. Zero or multiple matches is
a loud typed error naming what was looked for. Native vs Driver role comes
from the invoked binary's own name — the only signal that exists, since
build.yml compiles one binary per cell and copies it into both zips after
the fact, so no ldflags var could distinguish them.

The zip problem: every release asset is a zip holding one binary (never a
raw binary stream), so go-update's own DoUpdate — which feeds an HTTP
response body straight into selfupdate.Apply — cannot be used directly.
applyReleaseAsset downloads and unzips here, then hands the extracted binary
bytes to go-update's new DoUpdateFromReader, reusing its apply/rollback
machinery instead of re-implementing it.

The dev channel is fetched by its exact tag (GetReleaseByTag) rather than
through channel classification, and compared by plain string inequality
against the asset's own embedded version — never a semver.Compare on a
rolling tag. The semver channels go through CheckForNewerVersion, unpacked
via the new VersionCheckResult interface so this reuses go-update's own
comparison instead of re-implementing it.

CI: build.yml now stamps -X main.backend=<cpu|metal> alongside main.version
for the cpu and metal cells (asset-selection needs it), and a tag containing
'-' (v1.2.3-beta.1) now publishes prerelease: true instead of every v* tag
always publishing false, so go-update's channel filter sees prerelease tags
correctly.

Co-Authored-By: Virgil <virgil@lethean.io>