D1351 — The update check announces a release only when the user's channel can install it

Decision. Part of #1350 (the publish-last half is recorded in D1350). "A newer release exists" for the update check now means: the newest published stable release, and the channel the binary came from can install it. update notice, update check and the server's latest_version pass that channel to updatecheck.Check (Options.Channel); the check runs only when the release is newer than the running version, so a current binary costs no request. Homebrew: the cask in the tap (raw.githubusercontent.com, Casks/cartographer.rb) names that version. install.sh / install.ps1: the release carries this platform's asset (cartographer-<os>-<arch>, .zip on Windows) and sha256sums.txt, read from the release list the check already fetched. Container (server only): the image tag exists on ghcr.io (anonymous pull token, then a manifest HEAD). go-install and unknown: unchanged. A release that is not installable yet, or a channel check that fails, announces nothing and writes no cache entry; the tag is remembered in a short negative cache (<cache file>.pending, one hour, per channel, bypassed by update check) so that a session-start notice does not re-fetch the list at every start against GitHub's unauthenticated limit; Check returns ErrNotInstallable, which the server treats like any failed check (retry after an hour). A server that is not a container keeps the plain check and relies on publish-last (D1350).

Why. Publish-last closes the window of a release whose pipeline has not finished, but not the propagation lag after it (the tap is a separate repository, a retried job) nor a release published by hand. Caching "latest = X" while the channel cannot install X would have hidden the right answer for a day; failing silent and uncached keeps the check's contract (a hook never waits for or reports a failure) without that cost. The cask request sends no GITHUB_TOKEN: the tap is public and the raw host is not rate-limited like the API. The ghcr check is two small requests, and a private or unreachable registry only means no latest_version from that server, never a wrong one.