Let a failed update check say so, instead of reporting good news

The phone reported every build as current because the release repository is
private. Gitea answers 404 rather than 403 for a repo you cannot see, the client
reads that address anonymously, and AndroidUpdateChannel caught the failure and
returned null — which IUpdateChannel documented as meaning "this build is the
latest". The check had never once succeeded on any phone and nothing anywhere
said so.

Two faults, and the second is why the first lasted.

The seam said null was the honest answer for an unreachable channel, on the
reasoning that the caller does the same thing either way. That is true of the
six-hourly pass and false of CHECK NOW. UpdateViewModel already draws the line
correctly — silent on the timer, the exception's message on the button — and it
could only ever draw the first half, because nothing was ever thrown at it. The
desktop's channel does not catch, so the interface described neither
implementation.

So CheckAsync throws now, and null means one thing. A release that is reachable
but missing its manifest or the APK it names throws too: "you are up to date"
about a half-published feed is the same lie in a smaller costume, and the
self-healing that argument protected is untouched, since the timer still swallows
everything.

The precondition is written down where somebody would look, rather than left as a
sentence about where a token could live. ADR 0013 §4 already said a private
release repository was incompatible with this design; nobody checked which side
of it this repository was on. It is one curl, and manual-checks phase 16 now
opens with it — pointedly not against /api/v1/version, which answers 200 from a
forge that is up whatever is readable on it, and which is what made this look
like nothing was wrong.

Phone check 17.4 was the one that passed all along. It now presses CHECK NOW with
the network off as well as on, because two different answers are the whole of
what makes the first one worth reading.

docs/manual-checks.md

@@ -1766,6 +1766,25 @@ Walk it once per release, and in order — 16.6 onwards needs 16.1 to have happe
 Run `pwsh -File scripts/release-windows.ps1` first. It stops after packing, on purpose, so that everything
 below happens before anything reaches a user.
 
+### 16.0 The feed is readable without credentials · **do this one first, on either platform**
+
+Nothing else in this phase or the next means anything until this passes. Run it from anywhere, signed in to
+nothing:
+
+```bash
+curl -so /dev/null -w '%{http_code}\n' https://git.dodotech.cloud/api/v1/repos/DodoTech/DodoSSH
+```
+
+**Pass:** `200`.
+
+**Failure means:** `404` is a private repository — Gitea does not distinguish "not there" from "not yours" —
+and the clients read this address anonymously, because there is no token and deliberately nowhere to put
+one. Every check on every machine will answer 404 and the feature cannot work. See
+[ADR 0013 §4](adr/0013-desktop-distribution-and-updates.md).
+
+**Do not check `/api/v1/version` instead.** It answers `200` from a forge that is up regardless of what is
+readable on it, and that is exactly what made this look fine while nothing worked.
+
 ### 16.1 The installer needs no administrator, and lands beside the vault rather than on it · **the one that would destroy data**
 
 Run `Releases\DodoSSH.Desktop-win-Setup.exe` from an ordinary account. Then look at `%LOCALAPPDATA%`.
@@ -1917,15 +1936,30 @@ height. Never `1.0.0`.
 
 **Failure means:** `1.0.0` is the `_AndroidVersionName` fix having come undone; see platform-flags.
 
-### 17.4 A check that finds nothing says so, and one on a timer does not
+### 17.4 A check that finds nothing says so, a check that fails says something else, and a timer says neither
+
+**Walk 16.0 first.** This check is the one that used to pass while the whole feature was broken: with the
+repository private, every request answered 404, the channel swallowed it, and CHECK NOW reported the running
+build as the latest. It read exactly like success.
 
 Press CHECK NOW on the newest build there is.
 
-**Pass:** it answers — "DodoSSH x.y.z is the latest build." Then leave the app open and do nothing for
-several minutes.
+**Pass:** it answers — "DodoSSH x.y.z is the latest build."
 
-**Pass:** no message appears on its own. A background pass that found nothing is silent, which is what makes
-the feature tolerable.
+Now turn the phone's network off and press CHECK NOW again.
+
+**Pass:** it says it could not reach the forge, in whatever words the failure came with, and the section
+shows the failed state rather than a version number. **It must not say the build is the latest.** Those two
+answers being different is the whole of what makes the first one worth reading.
+
+Turn the network back on, and leave the app open doing nothing for several minutes.
+
+**Pass:** no message appears on its own, either way. A background pass that found nothing — or that could
+not ask — is silent, which is what makes the feature tolerable.
+
+**Failure means:** if the offline press reports the latest build, `AndroidUpdateChannel.CheckAsync` is
+catching again. Every outage then looks like good news, which is how this went unnoticed from the day it
+shipped.
 
 ### 17.5 An update is found, fetched without being asked, and installed only when asked · **the whole point**