feat(deploy): graph update transaction — N-artifact snapshots, barriers, quiescence [SD-4]

[rickylabs]

Part of #830.

Extends the #456 substrate to the graph: N-artifact manifests, service stop/start phases, per-step migration records + barrier-before-irreversible, maintenance(rollback-failed) terminal, data-root snapshot area, per-machine quiescence (refuse-by-default / --force+grace / version-handshake refuse-relaunch), updater bootstrap + release-resident worker (journal-first cold-boot resolution), install-graph digest accept/refuse, replay high-water + minBootstrapVersion.

Depends on: #456, #832, #831, #833, #826.

• gate: fault suite — crash-mid-junction, cold reboot with current absent, power-loss journal replay, torn tail, snapshot restore + ACL assertion, barrier before/during/after, previous-release-start-failure, sustained-health rollback, signed replay/downgrade + re-pin + bootstrap-version refusals, cross-session update

Design source: PR #822 (rfc.md + plan.md rev 10, 9-cycle adversarial trail) in .llm/runs/rfc-single-deployment--orchestrator/. (plan.md §C)