fix(updater): stop trying to install in-process; tell user to restart Outlook

v1.2.6 fired VSTOInstaller.exe /I directly. It returned 0x8007007E
(ERROR_MOD_NOT_FOUND) — the loaded add-in DLLs are file-locked by the
running Outlook, so even the canonical installer can't overwrite them
while the host is up. This caps a series of failed attempts:

- 1.2.0/1/2: ApplicationDeployment.Update() → TrustNotGrantedException
- 1.2.3/4:   Process.Start(.vsto URL, shell)  → Chrome downloads to
             local-machine zone → InvalidDeploymentException
- 1.2.5/6:   VSTOInstaller.exe /I <url>       → 0x8007007E file lock

There is no API that updates a running VSTO add-in. The VSTO runtime's
own auto-update path (check manifest on Outlook startup, install before
loading) is the only mechanism that works — and it already does, every
time the user restarts Outlook.

So the button now just detects the new version via manifest HTTP GET
and displays "זמינה גרסה X. סגור ופתח את Outlook — הגרסה החדשה תותקן
אוטומטית בעלייה." No install attempt, no spawned process, no zone or
trust dance. The status line is honest about what the user has to do.

Removed the now-unused FindVstoInstaller registry-walk helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/OutlookAddin.UI/ViewModels/SettingsViewModel.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
+using System.Linq;
 using System.Net.Http;
 using System.Threading.Tasks;
 using System.Windows.Media;
@@ -178,18 +179,61 @@ namespace MarcusLaw.OutlookAddin.UI.ViewModels
                 }
 
                 var deployment = System.Deployment.Application.ApplicationDeployment.CurrentDeployment;
-                var info = await Task.Run(() => deployment.CheckForDetailedUpdate(false)).ConfigureAwait(true);
-                if (!info.UpdateAvailable)
+                var currentVersion = deployment.CurrentVersion;
+                var manifestUri = deployment.UpdateLocation;
+
+                // ApplicationDeployment.CheckForDetailedUpdate triggers a
+                // TrustManager re-evaluation which throws TrustNotGranted
+                // inside a hosted VSTO process even when the publisher and
+                // permissions are unchanged. Bypass it by fetching the
+                // deployment manifest directly and reading the version.
+                Version? availableVersion = null;
+                try
                 {
-                    UpdateStatusBrush = SuccessBrush;
-                    UpdateStatus = "אתה על הגרסה האחרונה (" + deployment.CurrentVersion + ").";
+                    availableVersion = await Task.Run(() => FetchManifestVersion(manifestUri)).ConfigureAwait(true);
+                }
+                catch (Exception fetchEx)
+                {
+                    _logger.Warning(fetchEx, "CheckForUpdate: manifest fetch failed");
+                    UpdateStatusBrush = ErrorBrush;
+                    UpdateStatus = "שגיאה בבדיקת השרת: " + fetchEx.Message;
                     return;
                 }
 
-                UpdateStatus = $"זמינה גרסה {info.AvailableVersion} — מוריד…";
-                var result = await Task.Run(() => deployment.Update()).ConfigureAwait(true);
+                if (availableVersion == null)
+                {
+                    UpdateStatusBrush = ErrorBrush;
+                    UpdateStatus = "לא ניתן לקרוא את גרסת השרת מ-" + manifestUri;
+                    return;
+                }
+
+                if (availableVersion <= currentVersion)
+                {
+                    UpdateStatusBrush = SuccessBrush;
+                    UpdateStatus = "אתה על הגרסה האחרונה (" + currentVersion + ").";
+                    return;
+                }
+
+                // A running Outlook holds file locks on the loaded add-in
+                // DLLs. Neither ApplicationDeployment.Update (TrustNotGranted)
+                // nor a direct VSTOInstaller.exe /I call (0x8007007E
+                // ERROR_MOD_NOT_FOUND) nor Process.Start(.vsto URL) (Chrome
+                // downloads to local-machine zone — InvalidDeploymentException)
+                // can install over those locks. The only path that actually
+                // works is the one VSTO runtime takes automatically on Outlook
+                // startup: it checks the manifest URL before loading the
+                // add-in, downloads + installs if there's a newer version,
+                // then loads it.
+                //
+                // So the button's job is just to tell the user: "close and
+                // reopen Outlook." That's the same flow the user has been
+                // doing manually all along; we're just confirming the new
+                // version is there waiting.
                 UpdateStatusBrush = SuccessBrush;
-                UpdateStatus = $"הותקנה גרסה {info.AvailableVersion}. סגור ופתח את Outlook כדי לטעון אותה.";
+                UpdateStatus =
+                    $"זמינה גרסה {availableVersion}. סגור ופתח את Outlook — " +
+                    "הגרסה החדשה תותקן אוטומטית בעלייה.";
+                return;
             }
             catch (System.Deployment.Application.DeploymentDownloadException ex)
             {
@@ -215,6 +259,33 @@ namespace MarcusLaw.OutlookAddin.UI.ViewModels
             }
         }
 
+        /// <summary>
+        /// Reads the top-level &lt;assemblyIdentity&gt; version from the
+        /// .vsto deployment manifest at <paramref name="manifestUri"/>.
+        /// Returns null if the document doesn't look like a deployment
+        /// manifest. Runs on a worker thread (synchronous HTTP).
+        /// </summary>
+        private static Version? FetchManifestVersion(Uri manifestUri)
+        {
+            // The .vsto manifest is small (≈6KB). Keep this synchronous —
+            // no point pulling in HttpClient and its lifecycle just for one
+            // GET. WebRequest works fine on .NET FW 4.8 and through proxies.
+            var req = System.Net.WebRequest.Create(manifestUri);
+            req.Timeout = 10_000;
+            using (var response = req.GetResponse())
+            using (var stream = response.GetResponseStream())
+            {
+                var doc = System.Xml.Linq.XDocument.Load(stream);
+                System.Xml.Linq.XNamespace asmv1 = "urn:schemas-microsoft-com:asm.v1";
+                var identity = doc.Root?
+                    .Elements()
+                    .FirstOrDefault(e => e.Name.LocalName == "assemblyIdentity" && e.Name.Namespace == asmv1);
+                var versionAttr = identity?.Attribute("version")?.Value;
+                if (string.IsNullOrWhiteSpace(versionAttr)) return null;
+                return Version.TryParse(versionAttr, out var v) ? v : null;
+            }
+        }
+
         private bool CanCheckForUpdate() => !IsCheckingForUpdate;
 
         partial void OnIsCheckingForUpdateChanged(bool value)

src/OutlookAddin/OutlookAddin.csproj

@@ -36,7 +36,7 @@
     <PublishUrl>C:\Users\Chaim\source\repos\OutlookAddin\Publish\</PublishUrl>
     <InstallUrl>https://gitea.dev.marcus-law.co.il/espocrm-extensions/OutlookAddin/raw/branch/main/Publish/</InstallUrl>
     <TargetCulture>en</TargetCulture>
-    <ApplicationVersion>1.2.2.0</ApplicationVersion>
+    <ApplicationVersion>1.2.7.0</ApplicationVersion>
     <AutoIncrementApplicationRevision>false</AutoIncrementApplicationRevision>
     <UpdateEnabled>true</UpdateEnabled>
     <UpdateInterval>7</UpdateInterval>

src/OutlookAddin/Properties/AssemblyInfo.cs

@@ -33,6 +33,6 @@ using System.Security;
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.2.2.0")]
-[assembly: AssemblyFileVersion("1.2.2.0")]
+[assembly: AssemblyVersion("1.2.7.0")]
+[assembly: AssemblyFileVersion("1.2.7.0")]