Add trusted app and guest-image updates

[btsouth]

Add an update path for both the Windows launcher and the Omarchy guest image.

Updates must use the pinned manifest trust chain, stage files atomically, preserve the writable guest disk, recover cleanly after interruption, and offer rollback when a new launcher, runtime, or image does not boot.

[btsouth]

Implemented on master in c356495. Updates use signed metadata, verified hashes, atomic launcher and payload staging, and QMP health confirmation before removing rollback copies. The writable VM disk is never replaced. Keeping this open until v0.0.7 ships the updater and the following release exercises a real Windows update and rollback.

[btsouth]

v0.0.8 has now shipped after the updater landed in v0.0.7. The remaining close gate is to record a real v0.0.7 to v0.0.8 Windows update and a forced rollback test.

[btsouth]

Stable-version updates are in #34, including a bridge for older previews that miss a release. This stays open until the physical Windows update and forced-rollback checks pass, including the preview-to-stable path.