Wire lg-buddy updates install and upgrade messaging

[Staphylococcus]

Parent: #91

Depends on: #94, #95, #96, #97, #100

Outcome

Expose the verified, user-confirmed assisted upgrade as lg-buddy updates install and make checks and notifications point to that command.

Scope

• Add the public lg-buddy updates install command with no channel or arbitrary-version flags.
• Run the initial runtime host-compatibility preflight from Add runtime host upgrade compatibility preflight #100 before release discovery or downloading.
• Resolve the candidate from the saved updates.channel policy and perform a fresh metadata validation for installation.
• Refuse equal versions and downgrades.
• Show current and target identity and require explicit terminal confirmation.
• Acquire the verified bundle through Download and verify release bundles securely #97.
• Run the candidate-specific installer preflight from Add a non-interactive release-bundle installer upgrade mode #96 before sudo or mutation.
• Invoke the verified install.sh --upgrade directly without constructed shell text.
• Preserve the staged bundle until installer completion, then clean it up.
• Verify the installed binary version, channel, and commit after the installer returns.
• Add the unconditional install command to update-available manual output and notification bodies.
• Retain the release URL, View Release, Never Notify Again, and once-per-release notification policy.
• Keep updates background-check detection-and-notification only.

Acceptance criteria

• Initial host incompatibility prevents every release-client, download, confirmation, sudo, and installer call.
• Declined confirmation performs no download or mutation.
• Candidate-specific incompatibility prevents sudo and mutation.
• No update, downgrade, and concurrent install cases are actionable and non-mutating.
• Successful installation reports current and installed identities and passes post-install verification.
• Manual checks and notifications always show lg-buddy updates install when an update is available.
• Notification actions and background timer behavior remain unchanged.
• Public help, parser tests, mocked orchestration tests, and release-bundle CLI smoke coverage pass.

Out of scope

• Freezing the host-compatibility checks permanently; Add runtime host upgrade compatibility preflight #100 remains the refinement boundary.
• Host- or distribution-specific upgrade branches.
• Unattended or timer-triggered installation.
• GUI install actions, terminal launch, Polkit integration, or graphical progress.
• Arbitrary-version upgrades.