* GUI: verify updater releases by commit and SHA-256 * GUI: add updater rollback and version safeguards