[UI updates 2/6] Stage and verify bounded release artifacts

[srctl]

Stages pinned HTTPS artifacts with digest/identity checks, bounded safe extraction, schema/runtime compatibility validation and storage headroom checks before activation.

Layer 2 of 6 replacing original PR #11. Base: review/ui-updates-01-primitives. Merge in the order below; after each lower PR merges, retarget the next PR to main. If lower layers are squash/rebase merged, reconcile descendant branch ancestry before proceeding; do not merge the original monolithic PR.

Incremental scope: Artifact staging and extraction plus archive/download regression tests. These modules are not yet reachable through an updater CLI command or HTTP route.

Diff: 4 files changed, 710 insertions(+).

Verification at this cumulative head:

• Typecheck and app/CLI production builds passed.
• Full unit suite: 175 passed, 0 failed. Tests are introduced with their behavior, not deferred to the final PR.
• Checks use the unchanged locked dependencies, Node 24.15.0, pnpm 9.15.0, umask 022, and no inherited Roost binary overrides. Builds use isolated RAM-backed temporary storage. From layer 2, an uncommitted test allocator redirects only the download fixture to RAM storage because staging requires >2 GiB free; actual capacity/extraction/security checks are not mocked. Initial environment-only failures were corrected before the passing runs.
• This restructuring does not requalify intermediate packages for release or deployment. No new VM/native-browser lifecycle run was performed. The final aggregate tree equals original head 57fb9ae27ae602baba28d68e96af817208c89bdd; existing supported-platform evidence and limitations apply only to that complete tree.

Preserved operator guidance, matched screenshots and acceptance records · Full evidence and limits · Recovery boundaries

Stack and merge order:

1. [UI updates 1/6] Validate offers and protect update storage
2. [UI updates 2/6] Stage and verify bounded release artifacts
3. [UI updates 3/6] Journal transactions and recover matching release/data pairs
4. [UI updates 4/6] Enforce server admission and candidate readiness
5. [UI updates 5/6] Connect supervised helper, enrollment, CLI and authenticated API
6. [UI updates 6/6] Add Settings confirmation, reconnect and retained drafts

Original PR #11 cannot be the bounded top layer without changing its head: the new cohesive commits are not ancestors of its preserved head, and GitHub's merge-base comparison would include the original large implementation diff. Its history, review discussion, operator guidance and all 16 verified attachments are preserved. No docs/evidence are recommitted.