daemon: refresh updater after validated binary rollout

[euroelessar]

Why

bootstrap starts a detached pid-backed updater loop, but before this change that updater could keep running an old executable image even after install.sh replaced the managed standalone binary under CODEX_HOME. That left the updater itself behind the binary it had just rolled out, especially when the app-server was stopped or when the managed binary changed without a version-string change.

What changed

• Track updater identity from the executable contents rather than only the reported CLI version.
• Force the managed app-server restart path when the managed binary contents differ from the running updater image, then re-exec the updater from the managed binary once the rollout is in a safe state.
• Distinguish a genuinely absent managed app-server from a managed process that exists but is not yet probeable, so self-refresh does not skip a required restart.
• Keep the restart/re-exec decision under the daemon operation lock so bootstrap cannot race the handoff.
• Update app-server-daemon/README.md to document the resulting standalone and out-of-band update behavior.

Verification

• cargo test -p codex-app-server-daemon
• just fix -p codex-app-server-daemon

Added focused unit coverage for:

• content-based updater refresh decisions
• safe updater re-exec outcomes across restart states

[owenlin0]

btw, it seems like if we somehow get stuck with RestartIfRunningOutcome::NotReady it'd block the updater from refreshing. worth addressing?

also, as a follow up, may be worth adding some way to debug if the auto-updater refresh failed for whatever reason. perhaps logs written to stderr and we can pipe it somewhere on disk