fix(updater): relaunch after TCC reset so System Settings can re-register Thuki

[quiet-node]

Summary

After the TCC reset on app upgrade lands the user in a state where Thuki is gone from System Settings → Privacy & Security → Accessibility but cannot be re-added through the in-app onboarding flow. Clicking "Grant Accessibility" opens System Settings, but Thuki never appears in the list. The user has to manually quit Thuki (Cmd+Q) and reopen for the next AX call to re-register Thuki with macOS's tccd daemon.

Why

The Accessibility grant flow uses open_accessibility_settings (an open URL launch) rather than AXIsProcessTrustedWithOptions(prompt: true). The design assumed Thuki was already in the TCC list. After tccutil reset wipes the entry, that assumption breaks — and the running process keeps stale per-PID tracking in tccd that suppresses re-registration on subsequent AX calls.

A fresh process sidesteps the issue entirely: tccd sees a brand-new PID and registers it normally on the first AX query from onboarding's polling. Empirically the user reproduced this exact recovery — manually quitting and reopening the app worked every time.

Changes

• After tccutil_reset runs in lib.rs setup, the new last_launched_version is persisted to the sidecar before any restart (so the post-restart launch reads a sidecar that no longer indicates an upgrade — without this, the app would restart-loop).
• A short async task with a 150 ms delay then calls app.restart(), so Tauri finishes wiring up the rest of setup before tearing down.
• Existing tests cover should_reset_for_upgrade and the sidecar round-trips. The restart hook itself is a thin runtime wrapper (coverage(off)-style behavior) so no new unit test is added; the value is verified end-to-end by upgrading from v0.8.3 to v0.8.4.

Test plan

• bun run test:all:coverage clean (100% line and function coverage)
• bun run validate-build clean
• Manual end-to-end: install v0.8.4 over v0.8.3 via Settings → Check for updates → Install & restart. App should briefly relaunch itself after the TCC reset. Onboarding fires; clicking Grant Accessibility opens Settings with Thuki listed, toggle off, fresh csreq. Toggle ON → permission grants the running v0.8.4 binary. No Cmd+Q dance required.