Harden updater provenance recovery and private-release access; document validation

.github/workflows/release.yml

@@ -16,6 +16,8 @@ jobs:
           python-version: '3.13'
       - name: Install setup packager
         run: python -m pip install pyinstaller==6.19.0 numpy==2.2.6 Pillow==11.3.0
+      - name: Check updater without starting game
+        run: python -m unittest discover -s tools -p test_updater.py -v
       - name: Build Windows package
         shell: pwsh
         env: