#4 Updater: fetch releases from ermite first, GitHub as fallback

Context

zut releases are published on ermite (git.bnema.dev). The GitHub mirror still publishes a copy of each release, because the self-updater only reads GitHub:

• packages/agent/update.go: https://api.github.com/repos/bnema/zut/releases/latest
• packages/agent/changelog.go: https://api.github.com/repos/bnema/zut/releases/tags/<tag>
• packages/agent/updatecmd.go: the dev-build notice links to https://github.com/bnema/zut/releases

Change

• Read releases from https://git.bnema.dev/-/github/api/repos/bnema/zut/releases/... first (GitHub-compatible JSON, on one line), and fall back to GitHub on failure.
• Download archives and checksums.txt from the source that answered, pinned to the tag: https://git.bnema.dev/zut/releases/download/<tag>/<asset>.
• Allow only the hosts git.bnema.dev and github.com for downloads.
• Point the dev-build notice to https://git.bnema.dev/zut/releases.

Done when

• zut update moves from one release to the next through ermite, and through GitHub when ermite is down.
• Once most installs run that build, the GitHub copy of releases can stop: add if: github.server_url != 'https://github.com' to the job in .github/workflows/release.yml.