Fix Windows update file lock

[FaulMit]

What changed

• close cached-package streams before deleting invalid cache entries
• close download streams before promoting verified .download files
• bump Captail to 0.1.5
• document the one-time manual upgrade required for 0.1.3 and 0.1.4

Root cause

DownloadVerifiedAsync opened the temporary package with FileShare.None and called File.Move before the stream left its await using scope. Windows therefore rejected Captail's own rename with ERROR_SHARING_VIOLATION. The invalid-cache path had the same lifetime issue before File.Delete.

User impact

One-click updates work normally starting with 0.1.5. Users already running 0.1.3 or 0.1.4 must install 0.1.5 manually once because the faulty updater is part of their installed binary.

Validation

• deterministic update-download regression: download, SHA-256 verification, promotion, corrupt-cache replacement
• Debug build: 0 warnings, 0 errors
• Release build: 0 warnings, 0 errors
• dotnet format --verify-no-changes
• NuGet transitive vulnerability audit: clean