fix: make core self-updates atomic on macOS

[LovePeachBlossom]

Summary

• The latest version causes file truncation and corruption when the Clash Verge core self-updates.
• Before installing a new core, handle, sync, close, sign, and verify in stages.
• Preserve file permissions and Unix ownership information.
• Support backup and rollback, and perform atomic replacement of executable files.
• Clean up temporary update files.

Testing

• Updater unit tests and race condition tests have passed.
• The full test suite passes both with and without the with_gvisor tag.
• golangci-lint reported no errors in the updater modifications.
• Cross-compilation for Linux, Windows, and Android succeeded, but no on-device runtime verification was performed.
• Signing, verification, and atomic replacement on macOS have been manually verified.

[Copilot]

Pull request overview

This PR updates the core self-update flow to avoid executable truncation/corruption (notably on macOS) by staging updates next to the target binary, syncing/signing/verifying, and then performing an atomic replacement with backup/rollback support.

Changes:

• Resolve symlinks for the current executable and replace the in-place copy logic with a staged + atomic rename workflow.
• Add cross-platform helpers for signing/verification (darwin), directory/file syncing, and ownership/mode preservation.
• Add unit tests covering failure modes (copy/sign/rename), successful replacement cleanup, ownership preservation, and rollback.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
component/updater/update_core.go	Reworks Update() to stage/sign/verify then atomically replace; improves backup and adds rollback path.
component/updater/update_core_file.go	Introduces shared atomic stage/commit helpers, metadata preservation, and stale staged-file cleanup.
component/updater/update_core_sign_darwin.go	Implements macOS codesign signing/verification for staged binaries.
component/updater/update_core_sign_other.go	No-op signing/verification on non-darwin platforms.
component/updater/update_core_sync_unix.go	Adds Unix file/directory syncing helpers (fsync) for durability.
component/updater/update_core_sync_windows.go	Windows-specific sync stubs aligned with Windows behavior constraints.
component/updater/update_core_sync_other.go	No-op sync helpers for unsupported/other platforms.
component/updater/update_core_owner_unix.go	Captures/applies uid/gid ownership for Unix-like platforms with permission-aware behavior.
component/updater/update_core_owner_other.go	Ownership stubs for non-Unix platforms.
component/updater/update_core_test.go	Adds unit tests for atomic replacement behavior and cleanup guarantees.
component/updater/update_core_owner_unix_test.go	Adds Unix-only tests for ownership and backup metadata preservation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.