Update Sparkle to 2.9.6 for macOS security fixes

[CoAirFlow]

Foqos currently resolves Sparkle 2.9.5; the official Mac 0.1.5 DMG also contains a Sparkle framework reporting 2.9.5. Sparkle 2.9.6 fixes two published local security issues:

• GHSA-3x7w-j75x-ppq5: a symlink race during archive movement can affect privileged installation, subject to tight timing and filename constraints.
• GHSA-4v99-qgq9-6pxp: unsafe cache handling when the updater host itself runs as root, such as a CLI or daemon. This prerequisite has not been established for Foqos's normal GUI updater.

This updates the affected dependency. Successful exploitation against Foqos has not been demonstrated. See the upstream maintainer's applicability notes.

Changes:

• Raise the Xcode project's minimum Sparkle version to 2.9.6.
• Update the resolved pin to the official 2.9.6 commit, ac2def288cbff5cfc7df3ffef6abdf45b72bcb0a.

Validation:

• Verified the resolved commit against the fetched upstream tag and checked its package manifest and changelog.
• Parsed the lockfile and checked version consistency and its unchanged origin hash.
• Passed git diff --check and checked clean patch application against the current base commit.
• Native validation is pending: make lint and make build could not run in this Linux environment because swift-format and xcodebuild are unavailable. Please run the project's macOS/Xcode checks before merging.

A new Mac release containing the updated framework is needed to deliver these fixes to users; merging this PR alone does not update existing installations. Sparkle initialization is independent of the iCloud sync setting.

Prepared with AI assistance; source and packaged framework metadata were inspected without executing an exploit.