Fix updater detection for extracted single-file builds

[3vcloud]

Summary

• detect published apps from the populated .NET bundle header instead of Assembly.Location
• keep ordinary apphosts and dotnet development runs unsupported
• add regression coverage for apphost placeholders and cross-buffer bundle headers

Verification

• dotnet test tests/Slopterm.Tests.csproj (60 passed, 5 skipped)
• npm run build
• npm run lint
• published linux-x64, win-x64, osx-x64, and osx-arm64
• ran the Linux single-file publish and confirmed /api/update/check reports supported: true
• exercised /api/update/apply against the rolling release; download, verification, executable swap, restart, and launch-token preservation succeeded
• Android workload installed, but Android publish is blocked on this runner because the Android SDK is unavailable (XA5300)