feat: src/launcher.py — Python update launcher (HTTP, app/app.old swap)

Launcher core that reuses services/update_service: seed default config into
~/.cmbot on first run, check the manifest, download the release zip, verify
SHA-256, extract, validate version, swap into app/ (keeping app.old/ for
rollback), then launch app/CMBot.exe. Degrades to the local version on any
failure; checks install-root writability before updating.

- update_service: UpdateInfo gains sha256/size/min_supported; release URL
  resolved to absolute; extract make_auth_header + add download() helper
- tests/test_launcher.py: 11 tests (seed, find-root, swap, sha mismatch,
  no-update); also verified end-to-end against a local HTTP server

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tasks.md

@@ -933,7 +933,7 @@
 
 - [x] 文档：`docs/10` 改为便携 + `Launcher.exe` + `~/.cmbot` 模型（§3/§4/§5/§8/§9/§11/§16）
 - [x] `get_data_dir()` 三级回退：`CMBOT_DATA_DIR` → 打包态 `~/.cmbot` → 开发态项目根；`tests/test_file_service.py` 5 个单测
-- [ ] `src/launcher.py`：复用 `update_service`，下载 zip→SHA-256→解压→`app/app.old` 切换→启动；安装根可写性检测；首次把 `app\config\` 默认模板播种到 `~/.cmbot`
+- [x] `src/launcher.py`：复用 `update_service`，下载 zip→SHA-256→解压→`app/app.old` 切换→启动；安装根可写性检测；首次把 `app\config\` 默认模板播种到 `~/.cmbot`；`update_service` 扩展（`UpdateInfo.sha256/size/min_supported`、绝对 url 解析、`make_auth_header`/`download`）；`tests/test_launcher.py` 11 个单测 + 本地 HTTP server 真实端到端验证
 - [ ] `build.ps1` 增产 `Launcher.exe`（PyInstaller onefile），发布 zip 含 `Launcher.exe` + `app\`
 - [ ] 退休 `scripts/update.ps1` 与 `scripts/install_local.ps1`
 - [ ] 端到端实测（解压到 D 盘运行、自更新、回滚）