[datlechin]

Why

There is no way to get a release before everyone else, and the update feed is an unsigned file on raw.githubusercontent.com. Step 20 of the release rewrite; it merges in the freeze window with steps 20-23.

Change

• Settings > General > Software Update gets Get beta updates, off by default. On, Sparkle also takes items on the beta channel. Off again, the installed beta stays until a newer release ships.
• The setting is com.TablePro.updates.receivesBetaUpdates: device-local, never synced, and pinnable by a configuration profile.
• The feed moves to https://updates.tablepro.app/appcast.xml under the new EdDSA key, with SURequireSignedFeed and SUVerifyUpdateBeforeExtraction on.
• Removes the test-only requiredInfoPlistKeys and keysMissingDefaults, and the unused check-sparkle-update-defaults.sh probe.

Verified

• UpdateChannelTests (new) and PreferenceKeysGuardTests pass.
• SparkleUpdatePreferencesTests changed on purpose: it now holds the required-key list and pins the exact feed URL and both signing keys.

Not in this PR

• Nothing publishes a signed feed at updates.tablepro.app until step 23 (release.yml), so no release ships between this merge and v0.82.0-beta.1.
• Docs: docs(updates): add Beta updates and its managed preference docs#32, already merged.