docs: design safe UI-initiated self-updates

[srctl]

Roost has a CLI updater but no safe UI-initiated update flow. This design recommends a separately supervised updater for enrolled Linux x64 systemd packages, reusing release staging while adding durable recovery, explicit authorization, and complete work draining.

The document independently reviews source at f966874 (0.1.39), identifies current limitations, and specifies installation support, request security, UI/reconnect states, backup and migration compatibility, activation/health/rollback, alternatives, delivery phases, and a future fault-injection test matrix. It distinguishes release-manifest format from database schema and accounts for coding jobs that current maintenance stops monitoring.

Verification:

• Checked current CLI, installer, packaging/release workflow, lifecycle, settings/auth, stores/migrations, runs, coding jobs, and deployment guides against source.
• Validated 35 relative file links/anchors and Markdown headings, fences, table structure, whitespace, and final newline; git diff --check passed.
• Inspected five linked primary external sources (systemd upstream manuals, GitHub release API, SQLite backup, OWASP CSRF). Rendered systemd manuals returned 403; upstream manual source was accessible and is cited.

Limits: documentation only; no app tests or live installer/update/restart experiments were run. Runtime guarantees require the proposed isolated VM and failure-injection tests. No UI or host configuration changed; before/after screenshots are not applicable. No updater is implemented by this PR.