Implement signed A/B updates and graphical rollback

[55515-code]

Goal

Implement TUF-authorized updates into an inactive boot slot with health commit, automatic fallback, and graphical rollback.

Acceptance criteria

• Transport cannot authorize installation.
• Interrupted download/stage, invalid metadata, disk-full, failed boot, and failed health check are fault-tested.
• Last-known-good rollback and recovery UI work without a terminal.
• Stable promotion remains human and threshold gated.

[55515-code]

Archived after the LuigiOS architecture transition merged in #11. The Batocera/Steam Deck/Plasma assumptions in this issue no longer describe the product on main. Current work targets the CachyOS/COSMIC developer workstation, transactional recovery, and rootless SDK. See #12 and the current roadmap for active contribution lanes. This issue remains public as historical context; it is not an active commitment.