feat(installer): add explicit Linux rollback

[kricha-lab-dev-worker]

Summary

• add root-only, no-argument forge rollback for one exact older retained Linux release
• retain and safely rotate a hardened /opt/.agent-forge.previous release-owned slot after successful upgrade readiness using no-replace first publication and exchange-only validated rotation
• validate current/slot receipt identity, owner/mode/hash/key sets, schema/account/architecture, preserved token/config bindings, trusted paths, recovery state, and the actual per-object source/destination filesystem topology before any service mutation
• swap only binaries/plugins, systemd unit files, and receipt under the existing installer lock; preserve config, secrets, SQLite, account state, and systemd links
• restore both releases and re-prove the original Gate/Worker on handled publication/service/readiness failure; retain a secret-free marker if exact restoration fails
• disposable privileged E2E pins canonical v0.1.3 assets, upgrades to the exact candidate, runs candidate doctor, rolls back, proves all five old identities plus authenticated readiness, verifies the candidate slot, and compares SQLite/mutable preservation markers

Safety contract

• no network or asset inputs during rollback
• running CLI build identity must exactly match the current hardened receipt
• target must be strict older SemVer and the same persisted-storage compatibility epoch; the epoch covers incompatible schema and persisted semantic changes
• canonical marker-less v0.1.3 bridge only
• no binaries executed during validation
• no secret values emitted
• one-shot rollback: the resulting newer slot is rejected by a second rollback

Verification

• strict RED→GREEN TDD for successful retention/rotation/rollback and each negative/failure slice
• go test -count=1 ./...
• go test -race -count=1 ./cmd/forge ./internal/linuxinstall
• go vet ./...
• go build ./...
• sh -n scripts/*.sh
• /usr/bin/python3 scripts/linux-installer-diagnostics.py self-test
• git diff --check
• independent exact-tree pre-commit review required before commit

Tracking

Part of #43. Keep #43 open for uninstall, online bootstrap/download, Homebrew, and remaining lifecycle work.