fix: update Core and updater atomically

[frahlg]

Summary

• treat Core and updater as one versioned control-plane release pair
• publish updates only after a release manifest pins and re-verifies both immutable image digests
• update updater first and Core second through a detached transaction owner, retaining both previous image IDs for rollback
• keep Core health/readiness fail-closed until the matching updater and state migrations are ready
• add the v1.3.1 compatibility fixture, migration rollback coverage, operator documentation, and a changeset

Root cause

Core and updater were published and replaced independently. A legacy updater could accept a new update request while replacing Core only, and the boot health endpoint reported success while state initialization or migration was still running. That allowed a mixed control plane or a false-success commit boundary.

Impact

Core now verifies updater protocol and exact release identity before opening state. Paired updates commit only when both services run the requested immutable tag and Core is fully ready; any failure restores updater first and then Core from their retained image IDs. Optimizer, drivers, authentication, persistent data ownership, and the control loop remain outside this change.

Validation

• make verify
• pre-push make verify-all including linux/arm64, linux/amd64, and windows/amd64 cross-compiles
• npm test (48 tests)
• v1.3.1 updater compatibility fixture
• paired release digest, readiness, rollback, migration, and transaction-lock regressions

Rollout gate

1. Publish and verify the paired beta manifest and both live digests.
2. Confirm a v1.3.1 updater attempt restores old Core without migrating state.
3. Reconcile a test site to the same beta tag for Core and updater.
4. Exercise beta-to-beta updater, Core, and readiness failures and confirm both prior image IDs are restored.
5. Promote the exact tested beta commit; stable remains draft until the pair gate passes.

[frahlg]

Superseded by #628, rebuilt from current master. #593 is 50+ master commits behind and has content conflicts in the updater. Master already preserves per-component rollback image IDs and checks Core readiness; the old branch also bypassed the newer healthy-Optimizer preflight. #628 keeps those master fixes and carries only the current Core/updater pair contract, tests, changeset, release gate, migration rollback, and operator notes. No commit from #593 will be merged.