feat(macos): let administrators disable in-app updates

[kitlangton]

Why

Organizations that deploy HEX with Munki or another MDM need to control which version is installed. Automatic installation is already off, but background checks and Check for Updates still let users pull a newer build (#100).

What Changes

A Boolean DisableUpdates preference in the com.kitlangton.hex2 domain turns off in-app updating.

When DisableUpdates is true at launch

• Sparkle is never loaded, so there are no background checks, manual checks, downloads, or installs.
• HEX > Check for Updates… is removed from the app menu.
• The menu-bar item shows a disabled Updates Managed by Your Organization in its place.
• The sidebar Update button cannot appear, since no update is ever found.

When it is absent or false, nothing changes.

HEX reads the effective NSUserDefaults value once at launch, so a value forced by a configuration profile takes precedence over a local one. Changes apply after relaunch. Speech-model downloads are unaffected. The README documents the profile key and a defaults write command for a single Mac.

Scope

Fixes #100. There is no Settings UI for this; it is an administrator preference.

Verification

cargo fmt --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test
git diff --check

• 492 tests passed, 13 ignored. No automated test covers the preference read or the menus; it will be checked on the signed release candidate with defaults write com.kitlangton.hex2 DisableUpdates -bool true before publishing.