updater: add built-in Windows updates

[amanthanvi]

For your pull request to not get closed without review, please confirm that:

• An issue exists where the maintainers agreed that this should be implemented.
  If such issue did not exist before, I opened one.
• I tested that my contribution works locally, and does not break anything,
  otherwise I have marked my PR as draft.
• If my contribution is non-trivial, I did not use AI to write most of it.
• I understand that I will be permanently banned from interacting with this
  organization if I lied by checking any of these checkboxes.
• The pull request contents are only relevant to the Windows platform, and can in
  no way be applied to other platforms.

---

Adds an in-process WinSparkle-based updater for Helium on Windows, wired through the existing Helium services preference/origin plumbing and reusing the NSIS installer in /UPDATE mode.

Summary

• integrate WinSparkle into the Windows Chromium patchset and Help/About updater flow
• initialize the updater during browser startup
• route Windows browser update URLs through the existing Helium services pref/origin plumbing
• bundle WinSparkle.dll into official Windows build outputs
• add an NSIS /UPDATE mode for updater-triggered installs and move temporary extraction to $PLUGINSDIR

Validation

Ran locally:

• ./helium-chromium/devutils/lint.py -t .
• bash ./devutils/check_patch_files.sh
• git diff --check

I could not do a real Windows build/runtime test from this Linux host, so this is opened as a draft.

Companion PR

• updates: add Windows appcast plumbing helium-services#61

Notes

This keeps the existing Helium privacy/update control surface intact:

• update fetching is still gated by the existing Helium services toggle
• the appcast URL still comes from the configured Helium services origin

This version uses HTTPS appcasts plus installer Authenticode verification before execution, but it does not yet add signed Windows appcast metadata / signer pinning with parity to the macOS Sparkle pipeline.

AI assistance disclosure

Assisted by the pi coding harness, including parallel pi subagent review passes. Models used during the work included anthropic/claude-opus-4-6, anthropic/claude-sonnet-4-5, openai-codex/gpt-5.4, openai-codex/gpt-5.4-mini, and openai-codex/gpt-5.3-codex.

I manually reviewed and curated the final diff.