[UI updates 1/6] Validate offers and protect update storage

[srctl]

Adds pinned release offers, compatibility and request validation, durable journals, protected complete-data snapshots, and shared kernel locking. Existing CLI operations now conservatively count uncertain coding work and refuse the enrolled legacy path.

Layer 1 of 6 replacing original PR #11. Base: main. Merge in the order below; after each lower PR merges, retarget the next PR to main. If lower layers are squash/rebase merged, reconcile descendant branch ancestry before proceeding; do not merge the original monolithic PR.

Incremental scope: Contracts, release metadata/security, journal/snapshot/lock/process primitives, CLI state, and their regression tests. No updater CLI command or HTTP route is exposed. The existing mixed ui-updates test file is introduced with its primitive tests; its final HTTP import/test arrives with layer 5 without moving or duplicating tests.

Diff: 10 files changed, 1392 insertions(+), 6 deletions(-).

Verification at this cumulative head:

• Typecheck and app/CLI production builds passed.
• Full unit suite: 172 passed, 0 failed. Tests are introduced with their behavior, not deferred to the final PR.
• Checks use the unchanged locked dependencies, Node 24.15.0, pnpm 9.15.0, umask 022, and no inherited Roost binary overrides. Builds use isolated RAM-backed temporary storage. From layer 2, an uncommitted test allocator redirects only the download fixture to RAM storage because staging requires >2 GiB free; actual capacity/extraction/security checks are not mocked. Initial environment-only failures were corrected before the passing runs.
• This restructuring does not requalify intermediate packages for release or deployment. No new VM/native-browser lifecycle run was performed. The final aggregate tree equals original head 57fb9ae27ae602baba28d68e96af817208c89bdd; existing supported-platform evidence and limitations apply only to that complete tree.

Preserved operator guidance, matched screenshots and acceptance records · Full evidence and limits · Recovery boundaries

Stack and merge order:

1. [UI updates 1/6] Validate offers and protect update storage
2. [UI updates 2/6] Stage and verify bounded release artifacts
3. [UI updates 3/6] Journal transactions and recover matching release/data pairs
4. [UI updates 4/6] Enforce server admission and candidate readiness
5. [UI updates 5/6] Connect supervised helper, enrollment, CLI and authenticated API
6. [UI updates 6/6] Add Settings confirmation, reconnect and retained drafts

Original PR #11 cannot be the bounded top layer without changing its head: the new cohesive commits are not ancestors of its preserved head, and GitHub's merge-base comparison would include the original large implementation diff. Its history, review discussion, operator guidance and all 16 verified attachments are preserved. No docs/evidence are recommitted.