fix(ci): point release-metadata checks at the relocated update and publish guards

CI run 121 failed at "버전·계약 정본 대조": earlier refactors moved update
gating from UpdateService into update-policy.ts (evaluateUpdateOffer ties
decideUpdate + isWithinRollout), the differential-download switch into
update-adapters.ts, and the Forgejo re-release guard into
lib/immutable-package-guard.mjs (sha256 comparison, abort on conflict).
The checks still looked for the old markers in the old files. They now
verify the same guarantees where the code lives, and the self-test's
negative case targets assertNoImmutableConflicts.

Also clears the lint gate: a control-character regex in Keycap (range now
starts at U+0020) and unused helpers in two red-team tests.

apps/desktop/tests/main/update-policy-redteam-r3-5.test.ts

@@ -66,7 +66,10 @@ describe('parseUpdatePolicy — 안전 필드 fail-closed', () => {
   })
 
   it('필드가 아예 없으면 기존처럼 기본값을 쓴다', () => {
-    const { killSwitch: _k, stagingPercentage: _s, ...rest } = BASE
+    // 두 필드를 뺀 정책 — 나머지는 BASE 그대로
+    const rest = Object.fromEntries(
+      Object.entries(BASE).filter(([field]) => field !== 'killSwitch' && field !== 'stagingPercentage'),
+    )
     const parsed = parseUpdatePolicy(rest)
     expect(parsed.killSwitch).toBe(DEFAULT_UPDATE_POLICY.killSwitch)
     expect(parsed.stagingPercentage).toBe(DEFAULT_UPDATE_POLICY.stagingPercentage)