feat(migration): source the migration tarball from the update manifest (stable→beta→unstable)

[mrosseel]

Replaces the hardcoded migration tarball URL with a lookup in the update manifest, so migration follows releases automatically instead of a pinned v3.0.0-migration URL.

What changed

• New _migration_version_info_from_manifest(): fetches update-manifest.json (brickbots nixos-manifest), walks channels stable → beta → unstable, and returns version_info (version, type, migration_url, migration_sha256_url) for the first available entry that carries a migration tarball. Skips unavailable entries and entries without a tarball.
• Unlock (7× square): now offers the first-available manifest target (was the hardcoded _MIGRATION_VERSION_INFO); shows "No release found" if the manifest has none.
• Public/automatic path: still gated by nixos_for_everyone (unchanged rollout control), but the tarball now comes from the manifest rather than the gate's nixos_url. _fetch_migration_config() no longer requires nixos_url — it only carries the gate flag.
• Removed the hardcoded _MIGRATION_VERSION_INFO.

Depends on the manifest carrying migration_url/migration_sha256_url, added by the release workflow in #516.

Tests

• 37 pass. Added TestFetchUpdateManifest + TestMigrationVersionInfoFromManifest (channel priority, beta/unstable fallback, skip unavailable, skip entries without a tarball, network/JSON failure → None). Updated the two obsolete _fetch_migration_config url-requirement tests.

Note: the new "No release found" string needs nox -s babel extraction before translation.

🤖 Generated with Claude Code

[mrosseel]

Added migration_size_mb to the manifest-selected version_info via a HEAD request on the tarball (follows GitHub's 302 to read the real Content-Length; omitted on failure so the confirm screen shows "?"). Previously the confirm screen would always have shown "Download: ?MB". Tests extended (39 pass).