Split PerformUpdate into download vs extract+install so the checksum
verification, archive extraction, and binary installation can be tested
end-to-end from a local archive without hitting GitHub. Adds hashFile
helper, unexported installFromArchiveTo (checksum → extract → install),
and exported InstallFromArchive wrapper. Includes 6 table-driven subtests
covering zip, tar.gz, checksum mismatch, empty checksum, missing binary,
and overwrite scenarios.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

downloadFile already computes SHA-256 while streaming the archive to
disk, but PerformUpdate was discarding that hash and installFromArchiveTo
would re-read the entire file in hashFile. Plumb the download checksum
through a precomputedChecksum variadic parameter so online updates skip
the redundant I/O pass. The public InstallFromArchive API and all
existing tests continue to work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

On Windows, os.MkdirTemp("", ...) can fail with "Access is denied"
when %TEMP% is restricted by antivirus, group policy, or permissions.
Add mkTempDir helper that tries the system temp dir first, then falls
back to creating a tmp/ subdirectory under the msgvault home directory.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Move temp directory creation with fallback logic from update.go into a
shared config.MkTempDir function. The function tries locations in order:
preferred dirs (caller-specified) → system temp → ~/.msgvault/tmp/.

This fixes a regression in build_cache.go where the CSV fallback temp
dir was hardcoded to filepath.Dir(dbPath), which fails for read-only DB
locations. It now passes the DB directory as a preferred dir but falls
back through system temp and ~/.msgvault/tmp/ if that's inaccessible.

Adds 5 test cases covering: system temp, preferred dir, empty preferred
dir, inaccessible preferred dir, and full fallback to msgvault home.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Probe whether chmod 0500 actually restricts writes before asserting
fallback behavior. Skips the test when running as root or with ACLs
that still permit directory creation, avoiding flaky failures in CI.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Explain why the rename-then-copy pattern works on Windows (running
executables can be renamed but not deleted/overwritten) and why the
.old cleanup is expected to fail silently for the current process.

Co-Authored-By: Claude Opus 4.5 <[email protected]>