feat(release): add explicit prerelease manager upgrades

[roodboi]

An existing next.1 channel retains its original manager, which cannot validate newer bundles containing shared MCP assets. Add an explicit upgrade-manager operation to adopt the reviewed newer manager without replacing installed bundles, runtime homes, launcher, or selected/previous versions. Ordinary installs still never replace the retained manager.

The operation accepts the exact shipped flat-layout predecessor, validates channel ownership and receipts, takes the existing exclusive lock, and applies quiescence checks to every retained version. A synced journal protects the two-file manager/hash transition: interrupted states refuse ordinary launch or selection until the same reviewed installer verifies and completes recovery. Original manager and receipt bytes remain available for inspection. Custom, changed, aliased, or ambiguous state is refused.

Validation:

• 32 isolated Python controls pass, including actual process exits at four publication boundaries, original/retained manager refusal, real M3 shell-launcher refusal, tamper and ownership negatives, retained data/identity checks, and flat → MCP → flat rollback.
• bun run typecheck, bun run check, staged privacy check, and git diff --check pass.
• Full suite: 2,072 pass, 68 skip, zero failures; CLI checks ran fresh and DB tasks used the shared cache.
• Standalone installer help exposes the new command. Independent read-only review found no actionable issue.

The native subprocess boundary uses the existing isolated test seam; this does not claim live VM acceptance or hardware power-loss qualification. No existing user channel was upgraded.

Refs HACK-1124.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[linear-code]

HACK-1124