fix(boatstack): recover detached updates safely

[bigboateng]

Summary

• bind controller-owned paths to their embedded or detached ownership boundary
• persist detached update operation receipts without treating external state as a repository escape
• recover invalid local install provenance from the committed stable pin
• document the recovery path and add an append-only release note

Test plan

• go vet ./...
• go build ./cmd/boatstack-helper
• go test ./...
• bash -n ../boatstack-distribution/install.sh.template
• python3 -m unittest discover -s labs/12-product-engineering-loop/tests -p "test_*.py"
• Boatstack release-note validation and append-only policy checks
• detached update E2E with dev/unknown local provenance and external operation receipts

Disclosure reviewed: public-safe implementation and synthetic fixtures only.