distribution: add bounded managed updater lifecycle

[turinglambdaai]

Closes #220.

Adds one opaque, bounded check/select/download state machine for Rivet applications instead of copying roughly 400 lines into every product.

Contract highlights:

• Authenticated manifest check with an independent deadline.
• One synchronized operation per updater and deeply immutable JSON-safe snapshots.
• Background download with byte progress, explicit cancellation, monotonic stall and total deadlines, and guaranteed partial cleanup.
• Fail-closed Windows/macOS/Linux and x64/ARM64 validation, stable rollout-bucket guidance, and deterministic verified destinations.
• Child manifest-fetch threads are terminated when a synchronous check is interrupted.
• Installation, elevation, restart, and health policy remain with the native host/platform adapter.
• Injected-transport tests are deterministic and perform no live network access.

Local evidence after rebasing onto current main: 9,059 Racket and Taskboard tests pass in an isolated temporary Racket environment.