perf(update): apply same-size format-2 sparse patches in place

[peters]

Purpose

Autoresearch round 10 on the auto/update/ surface (series: #252 → #256 → #265 → #270). Phase measurement showed the per-step bspatch (~0.9–1.2 s at benchmark scale) still reads the whole 1.06 GB source and writes a full temp copy even when one 64 MiB chunk (one 4 KiB page) changed — the format-2 identity bitset already tells the apply side which chunks are unchanged, but it only used them to skip the diff, not the write.

Behavior impact

• None observable on success or failure paths that matter. For same-size format v2 patches the file is patched in place: unchanged chunks are untouched, changed chunks are rewritten at their existing offsets (chunk boundaries align 1:1 at equal sizes → reconstructed file byte-identical to the temp-file flow). The target SHA-256 is one full read of the patched file afterwards — the step stays fail-closed (mismatch → same error message; tamper regression test unchanged).
• Size-changing patches and format v1 patches take the temp-file flow, exactly as before.
• The chain-walk tree is scratch space: the installed app is only touched by the separate atomic swap, so in-place patching on a failed step leaves no observable state (the tree is discarded either way).
• chunked_bspatch_file* public API is unchanged; new additive chunked_bspatch_file_with_progress_and_sha256_in_place + ChunkedBspatchResult. Apply side split into chunked/bspatch.rs (600-line guardrail).
• Harness fixes (first commit, needed for a valid baseline after Quiesce installed app before update swap #255/Write chunked patches in format 1 by default; format 2 is opt-in #267 landed):
  • Quiesce installed app before update swap #255 makes the update manager refuse to swap without the persisted process identity; the bench's raw-extraction install never wrote the runtime manifest — it now does, like a real install.
  • Write chunked patches in format 1 by default; format 2 is opt-in #267 defaulted chunked_patch_format to 1 (fleet-safe); the canonical bench now pins 2 to stay on the identity-chunk path that rounds 7–9 measured.

Test evidence

• RUSTFLAGS="-D warnings" cargo test --workspace — all green; new unit tests: in-place round-trip (hash + bytes + output-path untouched), all-identity no-op, size-change fallback, legacy-format fallback.
• clippy (all-targets/all-features + strict panic paths), rustfmt, maintainability — all clean.
• Same-session A/B (scale 1.0, seed 42, 48-core shared host), base = this branch minus the code commit:
  • Phase-instrumented 10-step pairs (×3): bspatch phase ~870/1,177/964 ms → ~648/648/587 ms per step; in-place path fired 30/30.
  • 100-delta wall clock: 147,030 / 161,507 ms vs 163,096 / 170,127 ms (−7.4% median; new < base in all 4 pairings).
  • Install tree byte-identical (bench asserts; output_size 1,214,024,073 on both sides); download bytes unchanged (503,524 B).
• Bonus measurement (recorded, no change): the per-step repack is at the zstd-3 MT-48 floor — publisher-side pack and client-side repack cost the same (~500–550 ms stable); the 0.6–3.0 s spread is host load, not algorithmic waste. Frame reuse would need a per-entry archive format change.