fix(update): admit release manifests and repair invalid versions

[andersalm]

Runtime now refuses an invalid installed version with a local repair instruction. An explicit CLI --force can install a verified signed release and restore the version record; operator check and apply retain strict refusal.

Before replacing the binary, Runtime parses the verified components manifest, resolves the host platform, and admits each applicable external component against the existing release checksum and installation-strategy rules. Refused input preserves the binary, manifest and source record. The standalone installer validates signed version syntax through the same expressions as the publisher policy, including non-empty build-metadata identifiers.

Validation:

• Four basic gates passed, along with installer-policy parity, release-policy tests, components-integrity self-test and Bash syntax.
• Namespace Linux x86 with pinned Rust 1.91: 25 update tests and one strict operator repair-hint test passed. These ran on c18c829e; final c278540e changes only shell policy and parity tests, with identical Rust sources and locks.
• Independent source review passed in the final second round after the empty-metadata finding was corrected.

Required CI and irzhywau review remain before merge. #108 owns complete-set staging and #109 owns restart after the retained operator exit 75.

Refs #156.

[andersalm]

Independent adversarial review (Claude Opus, run by the operator for Anders, 2 October; different model family from the author), head c278540.
VERDICT: FAIL. Blocking: validate_update_components_manifest (setup.rs:46-58) refuses local-copy and source-build for every external component on the host platform, but the shipped components.json still has vmlinux linux-arm64 strategy local-copy (line 1402) and llama-server linux-arm64 strategy source-build (line 1456), and publish-release.sh copies .external unchanged. After merge every elastos update on linux-arm64 (Jetson) would fail with 'development installation strategy'. Fix the shipped manifest or the policy in the same change, and add a test that admits the real published linux-arm64 manifest.
Non-blocking: the repair path treats an invalid installed version as empty, so --force accepts any correctly signed release, older ones included, and labels it an update rather than a rollback; add refused-case tests for a forced repair with a wrong signer, mismatched hash and wrong platform.

[andersalm]

Superseded by #248 (merged): component admission before replacement and --force repair.