macOS: offer Install on Quit after an update is downloaded

Feature request

On macOS, after Codex has downloaded an app update, please offer an Install on Quit option alongside an immediate restart/install option.

This would let a user continue an active session and have the pending update installed when they normally quit the app, rather than requiring an interruption at download time.

Desired behavior

• Once an update is downloaded and verified, offer:
• Install and restart now
• Install on quit
• Later
• Install on quit should apply the already-downloaded update after a normal, graceful app quit.
• If the app cannot safely quit, leave the update pending rather than risking session or work loss.
• Clearly indicate whether the app will relaunch after installation.
• Preserve the existing explicit-update and security behavior.

Feasibility research

This is feasible for a directly distributed macOS app, though it is implemented by the app updater rather than by a universal macOS preference:

• AppKit provides applicationShouldTerminate, allowing an application to participate in and, when necessary, defer a normal quit request: https://developer.apple.com/documentation/appkit/nsapplicationdelegate/applicationshouldterminate%28_%3A%29
• Electron's macOS autoUpdater is built on Squirrel.Mac. Electron documents that a successfully downloaded update is applied on next launch and exposes quitAndInstall() for an explicit install/restart: https://www.electronjs.org/docs/latest/api/auto-updater/
• Sparkle, a widely used macOS update framework, documents the same pattern: download while the app is running, then let an external updater install after the app terminates: https://github.com/sparkle-project/Sparkle/discussions/2169

This request is specifically for direct distribution. Mac App Store apps must use the Mac App Store update mechanism: https://developer.apple.com/app-store/review/guidelines/