C11-307: update Sparkle for macOS 26

[BenevolentFutures]

c11 currently bundles Sparkle 2.8.1, whose prebuilt update helpers can be rejected on macOS 26 with error 4005 and “agent connection was never initiated.” This raises the minimum version to 2.9.3, updates the native-generated lockfile, and uses 2.9.3 for the appcast tools. Other dependency versions stay unchanged.

The helper SDK mismatch and 2.9.3 fix are documented in cmux #6678. Sparkle 2.9.0 also adds earlier agent/status-service probing; 2.9.3’s release note describes a separate first-update fix for bundle identifiers ending in .app. The appcast script builds its tools from source, so removal of sparkle-cli from the binary distribution needs no change here.

The reported attemptUpdate early stop is absent: the existing check remains installable while checking and waits for Sparkle’s result. No updater source, error guidance, production feed, bundle identity or update UI changes.

Validation at c89ac3e: remote builder compilation and all four existing UpdateInstallerFailureMappingTests passed (invocation d27c6aabcaac4f088594a786cadde6b8, clean source, no overlay). The tests preserve manual-download guidance for actual installer failures and location guidance for disk-image/translocation failures. Native package resolution selected Sparkle 2.9.3/d46d456107feacc80711b21847b82b07bd9fb46e. Project plist lint, shell syntax and diff whitespace checks passed.

Signed updater proof passed on remote builder's macOS 26.6.2 sandbox (host 26.5.2), using notarized/stapled proof builds 30701 and 30702 from this exact source. Build A and build B used the artifact-only workflow with producer b0468fe. Both bundles contain Sparkle 2.9.3 and pass strict signature/Gatekeeper checks. Archive and asset hashes were verified before launch.

The real Check for Updates menu offered B; Install Update and Relaunch replaced A with running build 30702. The installed executable's hash matches the verified B artifact. B's real check reported current and returned from checking to notFound to idle after Sparkle's actual appcast reply. Proof logs contain neither 4005 nor “connection was never initiated.” Screenshots and logs are on the ticket. Normal relaunch presented the resume picker, so a fresh-B QA pass also captured the unobstructed current indicator and verified dismissal through the real Quit confirmation. Both disposable sandboxes were removed.

The proof bundle is com.stage11.c11.sparkle307, with a signed loopback feed at http://127.0.0.1:19307/proof/appcast.xml. This keeps the existing single-instance kill/relaunch behavior away from the installed fleet; C11-298 owns that fix. No release.yml dispatch or signing credentials on remote builder. Production release identity, asset digests and latest-ref state are unchanged.

Lattice: C11-307. Plan: .lattice/plans/task_01M3X6K2V81RAAX9WWJCSVSDJ0.md. Numbered Validator scenario and exact proof identities are in the validation comment. CI runs in parallel with independent review; the Captain gates landing on the exact head.