All addressed, and updated the button

1. Windows now has its own manual strategy: since the releases deliberately ship only a ZIP, the update button opens the release page instead of downloading an archive that can't install itself. The status stays available because nothing was installed.
2. codiff update no longer special-cases brew, it hands every packaged install to the app's self-updater. On the tap side I'd add auto_updates true together with the first release that ships this updater, not before: brew upgrade skips auto_updates casks unless --greedy, so flipping it while 1.9.2 is current would leave existing brew installs with no update path at all.
3. Downloads now stream to disk through a SHA-256 hash and are verified against the digest GitHub publishes for the asset before anything is opened. A missing or mismatched digest deletes the file and surfaces an error. This also removes the full in-memory buffering and sync write.
4. Linux assets are matched against process.arch (amd64/arm64 for deb, x86_64/aarch64 for rpm), with a fallback to an unmarked asset. An installer marked for another architecture is refused rather than opened.
5. All the update pill CSS (and its variables) moved to Desktop.css.

The pill itself now renders through the shared <Button> component and only layers an accent fill on top, so it picks up the squircle corners and sizing from the shared styles.

Awesome! I think we are getting close with this PR. I have a bit more feedback from my agent's review here:

Blocking: installer downloads can destroy an existing file

The updater downloads directly to the final filename in Downloads using createWriteStream(path). That truncates any existing same-named installer. If downloading or verification fails, the catch handler then deletes that path.

I reproduced this: an existing codiff_1.9.3_amd64.deb containing unrelated data was overwritten, failed verification, and disappeared entirely.

Relevant code: electron/updater.cjs lines 326–345⁠.

It should download to a uniquely created temporary path and only expose/open that file after verification. It must never truncate or remove a pre-existing user file.

Smaller bug: disabling update checks can leave the notification visible

checkForUpdates: false prevents future scheduled checks, but the updater initializes its status from the cached state before considering that setting. Someone who disables updates after an update was cached will continue seeing the pill indefinitely.

Relevant paths:

• Cached status initialization⁠
• Setting only guards scheduled checks⁠

This is less severe, but it contradicts the setting’s description and centrally managed installations.