What a macOS updater can verify, and what it cannot

An update prompt looks like one action, but the macOS path crosses three different trust decisions: release discovery, package verification, and first launch. Keeping them separate made Agent Island's