Fix stale update profiles and add one-click diagnostics

[Brian Krabach (bkrabach)]

Component updates could stop with BundleNotFoundError when an older cached registry contained aliases no longer registered in current settings. The picker and update preparation now use the same configured profile authority as the session loader, while retaining historical registry data.

Settings → Updates now offers Copy diagnostics and Save diagnostics through a shared read-only action. Reports include update phases, timings, versions, recorded-versus-installed source changes, and unresolved cached profile names from the known public catalog. Credentials, private paths, environment values, raw exception text and conversation content are excluded. Existing runtime-source protections and the explicit runtime repair action remain unchanged.

Validation:

• 53 focused backend tests passed, including stale registry admission, source provenance privacy and read-only action behavior.
• 436 frontend tests passed; production build passed.
• An isolated Linux fixture containing stale aliases completed real component preparation, fresh-worker compatibility checks and activation in 17.9 seconds; check took 1.3 seconds. No model requests were sent.
• 146 service, task capacity, coordination and runtime contract tests passed on Linux.
• Disposable real-systemd integration passed all four restart/readiness scenarios.
• Hosted Linux jobs remain queued; equivalent focused checks passed in an isolated Linux environment. Exact merged-commit release qualification passed: isolated wheel install/import/assets/login probe, all 436 frontend tests and reproducible assets, and 41 fresh-runtime tests with recorded dependency identities. The full Python suite completed separately: 4,662 passed, 138 skipped (PR head tree verified identical to the merged release commit).

Includes version 0.20.47 and rebuilt assets. This does not claim physical-device or real-provider-account acceptance.