Send the client id with desktop update checks

[mando]

Summary

The download service (argus-downloads) saw update checks as raw hits, so there was no way to tell one install checking hourly from many installs checking once. The tray app now attaches the per-install client id the store already mints, using the same x-argus-client header sync sends to a Hub.

One header map covers both updater requests: the plugin reuses it for the manifest check and the artifact download that follows, so the download service sees the same install on each.

Pairs with Agent-Deployment-Co/argus-downloads#1, which reads the header and uses it as the PostHog distinct ID. That side can deploy first; an unknown header is ignored.

Notes

• Timing. The id lives in argus.db, which the sidecar doesn't create until its first open, so a cold launch can ask before there's anything to read. Successful reads are cached, misses stay retryable, and the update loop waits up to 10s before its first check so a fresh install's first contact is attributable. That wait sits in front of maybe_open_on_first_run, hence the short timeout: a store that never appears costs that one check its id rather than holding the first-run dashboard open indefinitely.
• Privacy disclosure. docs/privacy.md now covers the identifier, including that it reaches GitHub when Argus downloads a version (the artifact request redirects there, and reqwest carries non-sensitive headers across hosts). docs/contributing/positioning.md owns that claim, so its privacy bullet is updated too; it also still described updates as coming from GitHub directly, which the Cloudflare change had made stale.
• Opt-out (second commit). Turning off auto-update doesn't stop the check, so desktop.metrics (on by default) gates the header. It's a visible Settings toggle under General > Updates rather than config-file-only: an opt-out nobody can find isn't much of an opt-out. The shell reads it at the point of use, like silent mode, so flipping it applies to the next check with no restart, and it also skips the client-id wait since there's nothing to wait for with metrics off.

Test plan

• cargo check clean; cargo test 10 pass
• New code is rustfmt-clean (the two cargo fmt --check diffs are pre-existing and untouched)
• bun test test/docs-download.test.ts
• bun test 696 pass, bun run typecheck clean (settings layout + resolveDesktopMetrics covered)
• After both sides ship: confirm a real check arrives in PostHog with a client-... distinct id, that a fresh install's first check carries one, and that toggling Share update metrics off makes the next check anonymous

🤖 Generated with Claude Code