Add desktop update diagnostics to codex doctor (#39074)

## What changed

- Probe the installed desktop app's update endpoint on macOS and Windows and report update-CDN reachability alongside the existing network diagnostics.
- Report newer Windows Store builds and macOS updates that Sparkle has staged for installation in the updates check and human-readable notes.
- Validate Windows update manifests against the production app identity, and use the persisted production appcast configuration when selecting the macOS feed.

## Testing

- Cover Windows version comparison and manifest identity validation.
- Cover macOS appcast selection and staged-bundle discovery.
- Verify the human-readable desktop update note.

GitOrigin-RevId: 1af5aa750144346b4b31f2b27a20371daf40d3c0

codex-rs/cli/tests/doctor_enterprise_network.rs

@@ -5,8 +5,10 @@ use std::process::Stdio;
 
 use anyhow::Context as _;
 use anyhow::Result;
+#[cfg(target_os = "macos")]
 use pretty_assertions::assert_eq;
 use serde_json::Value;
+#[cfg(target_os = "macos")]
 use serde_json::json;
 use tempfile::TempDir;
 use wiremock::Mock;
@@ -63,9 +65,10 @@ async fn invalid_custom_ca_falls_back_to_system_roots() -> Result<()> {
             .context("failed to run the doctor with an invalid custom CA")?;
         let report: Value = serde_json::from_slice(&output.stdout)?;
 
-        assert_eq!(
-            report["checks"]["network.provider_reachability"]["status"],
-            json!("ok")
+        assert!(
+            report["checks"]["network.provider_reachability"]["details"]["local API inference URL"]
+                .as_str()
+                .is_some_and(|detail| detail.ends_with("reachable (HTTP 200)"))
         );
     }
     server.verify().await;