feat: preferences for remote clipboard writes, multi-line paste confirmation and the launch update check

OSC 52 and VNC ServerCutText now go through one handler that honours
'allow remote clipboard' and always toasts the first line, so a silent
clipboard swap can't set up a paste into another shell (SEC-20261012-010).
Multi-line pastes into a terminal without bracketed paste ask first, with a
preview (SEC-20261012-017). The launch-time update check can be turned off
and the updater docs no longer claim it is opt-in; the unused GitHub
fallback is removed (SEC-20261012-013, F15).

rust/core/src/models.rs

@@ -538,6 +538,12 @@ pub struct AppPreferences {
     pub default_cursor_style: String,
     pub use_native_paste: bool,
     pub local_shell: String,
+    /// Check the update manifest once at launch.
+    pub check_for_updates: bool,
+    /// Let remote hosts set the local clipboard (terminal OSC 52, VNC ServerCutText).
+    pub allow_remote_clipboard: bool,
+    /// Ask before pasting multi-line text into a terminal that isn't in bracketed-paste mode.
+    pub confirm_multiline_paste: bool,
 }
 
 impl Default for AppPreferences {
@@ -556,6 +562,9 @@ impl Default for AppPreferences {
             default_cursor_style: DEFAULT_CURSOR_STYLE.into(),
             use_native_paste: false,
             local_shell: String::new(),
+            check_for_updates: true,
+            allow_remote_clipboard: true,
+            confirm_multiline_paste: true,
         }
     }
 }