feat: stable and latest update channels, flashing becomes optional

[cedbossneo]

Update channels (Moonraker's channel option, chosen in the installer, saved in
settings.env, --channel stable|latest):

• CI tags every passing version of main as vYYYY.MM.DD-beta.N ("latest");
  the daily upstream update tags its own commits.
• "Promote to stable" workflow: a beta tested on a printer gets vYYYY.MM.DD
  on the same commit ("stable", the default for new installs; existing installs
  get "latest", the closest to following main).
• Annotated tags: git describe prefers them over the fw-* release tags, which
  Moonraker could not read as a version.

Optional flash:

• The update from Moonraker no longer refuses a version that needs a flash: it
  updates everything else and keeps Klipper at the version of the flashed
  firmware, then a Mainsail/Fluidd dialog gives the command for later.
• ./install.sh update asks before installing anything whether to flash now;
  without a flash Klipper is kept. ./install.sh flash brings Klipper to the
  flashed version.
• A print running during an update also shows a dialog with what to do.

Test plan

• CI green (shellcheck, host install + unattended update user phase)
• tag-release.sh tested on a throwaway repo (beta, stable default/explicit, idempotence, bad input)
• moonraker.conf channel migration tested on a copy of a real install (idempotent)
• After merge: first beta tag created by CI; promote it once tested on the printer

https://claude.ai/code/session_01Ps7yQKNqsbUeCYzztPZT5q