Recover interrupted component updates and report restart failures

[fraa2a]

A failure after earlier component swaps left a mixed installation, and component versions were recorded before the updater self-swap. This follow-up addresses O01 and O02 from the repository audit.

Prepare all payloads before stopping processes, journal one file plan for engine/UI/updater and components.json, and restore the complete previous plan after failure. Recover interrupted prepared journals before the next updater check. Read the installed updater version and surface metadata, recovery and engine spawn errors. Updater version is 1.0.2.

Validation:

• 14 production-module Rust tests pass locally, including interruption at each of nine file moves, late metadata failure, repeat recovery, committed/aborted updates, foreign-file preservation, path aliases and links.
• Windows-target production modules and Windows-only tests type-check with cargo check --locked --tests --no-default-features --target x86_64-pc-windows-msvc --manifest-path tests/rust/Cargo.toml.
• Focused rustfmt, git diff --check and repository text policy pass.
• Windows recovery job passed on code commit dd92254: 11 tests passed, zero failed, including replacement/recovery of a running executable. The ignored helper is launched by that test. The latest commit only records this evidence in documentation. Full Tauri/native Windows build remains in progress.

Recovery requires a runnable updater; interruption between parking and placing its executable can require a retained updater or reinstall. Multi-file visibility is not instantaneous, external filesystem races and power-loss durability are not certified, and engine spawn does not prove readiness. Clean Windows installer/runtime validation remains open.

Details: follow-up report and ADR-0021. O03 through O14 remain open; this PR keeps the updater change focused. Packaging #3, audit #4 and comments #5 are already merged under the user's authorization to merge before Windows checks finish.