v0.23.3-rc0: Harden updater and Windows/Mac update verification via CI

AI Impact Summary

This release hardens the Windows update path within the Updater and introduces an opt-in mechanism plus CI-triggered unit tests to verify Mac/Windows updates with verification. The changes ensure update validations run in CI before delivery, reducing the likelihood of post-deploy update failures. Engineers should verify that test environments set OLLAMA_MODELS and monitor the new opt-in flow for any integration or telemetry implications.