Support ordinary App updates

[siwei-yuan]

Summary

• update an installed ordinary App through the existing package review and confirmation flow
• preserve App SQLite data and native credentials across code-only and schema updates
• add forward migrations/N.sql handling, rehearsal, atomic live migration, source swap, and boot completion
• refresh App tools, schedules, Action runtime, and View runtime after activation
• reuse the existing install UI for install/update review and keep UART/HTTP transport-neutral

Architecture

UART and HTTP still only transfer package bytes into staging. Both ingress paths converge on:

stage_pocketapp_bytes -> review_app -> physical confirmation -> apply_app

AppSupervisor decides install versus update from the installed catalog at review/apply time. No update behavior was added to the UART protocol or HTTP uploader. The UART helper only received neutral user-facing wording.

The durable update signal is the temporary .update/release directory. There is no AppInstallation record, release history, generation model, rollback mechanism, System App update, or Agent-exposed update API.

App version remains release metadata. schemaVersion alone models durable SQLite compatibility, with migrations/N.sql moving schema N-1 to N. Fresh install continues to create the final schema directly from schema.sql.

Validation

• cargo test --workspace: 51 passed
• bun test apps/pi-agent/text.test.js: 3 passed
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• Pi Agent assets built at the pinned PocketJS revision
• ESP32-P4 release firmware built successfully
• physical ESP32-P4 acceptance covered HTTP fresh install, UART code-only update, schema migration, reset persistence, downgrade and missing-step rejection, failing-migration rollback, and subsequent valid UART update

Temporary update fixture Apps used for board acceptance are not included in the repository.