Updater: update channel Stable / Dev in Settings → Updates; Dev stays on test builds after a release

Dev reads the dev and stable manifests and offers the newer by semver;
a test build stores Dev on its first start, so the release that updates
it keeps the channel. Switching to Stable in a test build asks before
going back to an older release. tool/dev_release.sh's one-time command
also writes the update-channel file that sets Dev.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DEVELOPMENT.md

@@ -316,10 +316,13 @@ minor / major when asked, and once such a line is published later runs
 follow it until a release moves the pubspec) and replaces the assets of the
 `dev` prerelease with the tarball and its `manifest.json` (`changes`:
 the changelog's Unreleased, which also becomes the prerelease's text). Dev builds
-update from it ([Updater](ARCHITECTURE.md#updater)). A stable install
-moves onto it once with the command the script prints (run with the app
-open: it finds the install from the running process and copies the new
-files over it).
+update from it on the Dev update channel, which a test build starts on
+and keeps after a release ([Updater](ARCHITECTURE.md#updater)). Any
+install switches channel in Settings → Updates; the command the script
+prints is a shortcut that moves a stable install onto the test build at
+once (run with the app open: it finds the install from the running
+process, copies the new files over it and writes the `update-channel`
+file that sets Dev).
 
 Tokens come from the environment (`RELEASE_TOKEN`, or Actions-provided
 `GITHUB_TOKEN`/`GITEA_TOKEN`). The manifest has no `sha256` by default; the