Add safe host self-updates

[notmike101]

Summary

• add stable-channel host update discovery at startup, every six hours, and on demand
• stage checksum-verified releases before an explicit Update and restart handoff
• apply only release-managed files with data preservation, backup, rollback, guardian coordination, and runtime fallback
• publish host-update.json and an internal managed-file release manifest
• bump host and SDK metadata to 0.3.6

Verification

• bun run check (45 tests passed)
• bun scripts/package-release.ts --verify-only --tag v0.3.6
• bun scripts/package-release.ts --tag v0.3.6
• generated archive size and SHA-256 match host-update.json; release manifest contains no data paths