Make Boatstack updates repair their own control state

[bigboateng]

Summary

• classify installed Boatstack state before updates and automatically migrate exact owned-stale hooks
• add fingerprint-bound --repair recovery for provably Boatstack-owned drift, with Git-common backups, atomic verification, and rollback
• bootstrap updates with the checksum-verified target helper so a broken installed control plane cannot block its own repair
• preserve the repair in the same fresh update branch and surface one safe interactive or noninteractive recovery path

Root cause

The installed helper and hook contract were treated as prerequisites for updating them. When an older Cursor hook used the retired preToolUse event, the target installer rejected it before the newer helper could classify and migrate that owned state. The repair path was therefore disabled by the state it needed to repair.

Developer impact

Exact stale Boatstack state now migrates automatically. Recoverable owned drift shows the exact affected paths and fingerprint, then asks before continuing with --repair. User-owned, mixed, ambiguous, malformed, symlinked, or unsafe state remains blocked. Downgrades still require separate explicit authority.

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• python3 -m unittest discover -s labs/12-product-engineering-loop/tests -p 'test_*.py'
• bash -n labs/12-product-engineering-loop/boatstack-distribution/install.sh.template
• release-note validation
• git diff --check

PowerShell projection and template assertions passed; a local PowerShell runtime was unavailable, so Windows parser coverage remains with CI.