feature(updater): Implement auto-updating system using AppCast protocol

AGENTS.md

@@ -46,8 +46,8 @@ dart run build_runner build --delete-conflicting-outputs
 dart format --set-exit-if-changed .
 flutter analyze
 flutter test
-flutter run -d windows --dart-define=MOONWELL_API_BASE_URL=https://host
-flutter build windows --dart-define=MOONWELL_API_BASE_URL=https://host
+flutter run -d windows --dart-define=MOONWELL_API_BASE_URL=https://host --dart-define=MOONWELL_APPCAST_URL=https://host/launcher/updates/appcast.xml
+flutter build windows --dart-define=MOONWELL_API_BASE_URL=https://host --dart-define=MOONWELL_APPCAST_URL=https://host/launcher/updates/appcast.xml
 ```
 
 See `docs/linting.md` for the required format, analyze, test, and Lefthook
@@ -61,6 +61,15 @@ The launcher API base URL is compile-time configuration:
 --dart-define=MOONWELL_API_BASE_URL=https://host
 ```
 
+The optional Windows self-update feed is also compile-time configuration:
+
+```powershell
+--dart-define=MOONWELL_APPCAST_URL=https://host/launcher/updates/appcast.xml
+```
+
+Production AppCast feeds must be public HTTPS URLs. Omit the setting to disable
+self-update in local builds.
+
 Do not commit private credentials, production secrets, temporary bearer tokens,
 or local-only API URLs.
 
@@ -71,6 +80,9 @@ or local-only API URLs.
   Do not store sessions or other secrets in `shared_preferences`.
 - File sync behavior should stay in `ClientSyncUseCase` and
   `GameInstallationService`.
+- Launcher self-update behavior should stay behind `LauncherUpdateService`.
+  Windows updates use WinSparkle/AppCast and the signed Inno Setup artifact;
+  they are separate from game-client synchronization.
 - The server manifest is the source of truth for client files.
 - Downloads must write to `*.moonwell.part`, verify size and SHA-256, then
   replace the destination file only after successful verification.