Let Pi Agent iterate installed Apps

[siwei-yuan]

Summary

• add the two Agent-facing lifecycle tools app.checkout and app.submit
• keep editable source at apps/<id>/checkout without copying App data, temp files, or credentials
• validate and rename submitted source into the existing Installer staging so HTTP, UART, and Agent updates share the same review UI and AppSupervisor::apply_app path
• teach the firmware and simulator prompts the version/schema migration workflow and document the directory lifecycle
• leave the physical Agent checkout/edit/submit/confirm E2E pending until the test board is available again

The implementation adds no installation record, release history, rollback state, or second updater. A successful submit consumes the checkout with a same-filesystem rename; physical dismissal discards the staged candidate.

Validation

• cargo test --workspace
• bun test apps/pi-agent/text.test.js
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo xtask build esp32-p4 with the pinned PocketJS checkout

Note

Do not merge yet. Wait for the physical Agent checkout/edit/submit/confirm E2E.