feat(installer): add safe Linux upgrade rollback

[kricha-lab-dev-worker]

Summary

• add explicit exact offline forge install --upgrade for strict newer SemVer releases
• preserve config, secrets, repositories, worktrees, runtime files, and SQLite state
• replace only release-owned binaries, systemd units, and receipt
• readiness-verify Gate → Worker and automatically restore/re-prove the exact previous release on failure
• fail closed on incompatible schema, downgrade, concurrent invocation, unsafe paths, or non-target CLI identity
• add privileged GitHub-hosted A→B upgrade acceptance and deterministic fault tests

Safety invariants

• same-version invocation remains validation-only with no rewrites or systemctl
• exclusive nonblocking lock spans inspection, publication, rollback, cleanup, and old-release recovery
• receipt is published last as the commit marker
• staged modes are canonical under umask 077
• per-file publication is protected by stopped services and the held lock; crash recovery remains explicitly out of scope for this increment

Verification

• go test -count=1 ./... — 928 passed
• go test -race -count=1 ./internal/linuxinstall ./internal/store — 382 passed
• go vet ./... — passed
• go build ./... — passed
• clean-source deterministic release-artifacts E2E with v999.0.0 — passed
• exact rootless Linux installer E2E — passed
• independent security/correctness review findings resolved

Part of #43