feat: add live workspace tooling updates

[AlenHay]

Summary

• add a strict declarative tool manifest for Claude Code, Codex, Bun, and Go
• install side-by-side releases with atomic switches, selected-latest persistence, rollback, locking, and in-use retention
• verify Go archives against go.dev SHA-256 metadata and staged CLI versions before activation
• render the updater into the stock workspace image and document its privilege/supply-chain model
• add isolated lifecycle/failure tests and a full workspace-image CI build

Verification

• shellcheck templates/entrypoint.sh.tmpl templates/vswarm-tooling.sh.tmpl scripts/*.sh
• go test ./...
• go vet ./...
• gofmt clean
• actionlint .github/workflows/ci.yml
• ./scripts/test-vswarm-tooling.sh
• rendered build-context smoke test
• Hadolint v2.12.0
• upstream package/version availability for every approved pin

The hosted workspace-image job builds the complete amd64 image and verifies all approved tools report current before merge.