* fix(drivers): make version switching work, and reversible

Four faults, each hidden behind the one in front of it.

The signed channel could not install anything at all. parseCatalogEntry only
matched a DRIVER table written inline, but tools/ftw_repository.py assigns it
from a local -- twice, so a driver cannot overwrite the identity it was signed
under. Every signed artifact therefore parsed as empty metadata and
validateLuaArtifact refused it with "driver metadata id/version @, want
ferroamp@1.1.1". Update failed the same way; nobody noticed because nothing
reached that far.

The Versions panel from #672 rendered zero rows. GET /versions answers with
VersionCandidate -- {repository_id, driver:{version}, installed?} -- and the
picker read .version off the outer object, so the guard dropped every row. Its
install call also omitted repository_id, which the endpoint requires. The test
that was meant to cover this matched the source with a regex, so it passed
against an empty panel.

Rolling back the first managed install was refused: PreviousInstalledPath is
empty, and the bundled driver is not an install to step back to. That is the
common case -- installing over the bundled driver is the first thing anyone
does when trying a new one. Rollback now removes the managed entry, which is
what makes core resolve the bundled copy again, and the restart points config
at the bundled path rather than the symlink it just deleted.

The row itself said BUNDLED · V1.0.0 beside three buttons, where Rollback was a
subset of Versions and bundled/managed/local is our vocabulary. Every driver
runs locally; what matters is which version runs and what you can switch to. So
the row now reads "v1.0.0 · official, shipped with this build · verified on
hardware", the catalog's verification_status finally appears where updates are
chosen, and one Versions list replaces Rollback. After a switch, Undo puts the
old version back -- activating it when it is retained, rolling back when it is
the bundled copy -- and re-arms the switch so trying again is one click.

The web tests now drive the real code with the payload the API really returns.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(drivers): a standing way back to the bundled driver, not a transient undo

An external review found that removing the Rollback button left no lasting way
back. /versions lists signed and retained artifacts; the bundled copy is
neither, so once a channel version was installed the only path back lived in an
Undo button that vanished when the panel closed.

Worse, the rollback-to-bundled path added in the previous commit could take a
driver offline. Not every driver the channel offers is bundled, and pointing
the restart at a file that is not there makes Registry.Restart remove the
working instance before Add fails. The recovery path then called Rollback a
second time, which had already deactivated the only active row and had nothing
left to restore -- the "sql: no rows in result set" seen while testing.

So going back to the bundled copy is now its own operation rather than a step
inside Rollback. UseBundled checks the bundled file exists before deactivating
anything, and returns the artifact it replaced so the caller can put it back if
the bundled driver fails to start. Rollback returns to refusing a first
install, which keeps its own recovery path intact. The version list carries a
standing "the copy shipped with this build" row, so the way back survives
closing the panel.

Also from the review: the dedupe key was the version alone, which dropped one
of two repositories publishing the same version with different hashes -- the
hash is the artifact's identity, so it is the key. A row fetched from the
channel now records that it is on disk, so a second attempt activates it
instead of downloading again and failing offline. Undo picks its route from
what was running rather than from a version number, since a managed artifact of
the same version can sit on disk and differ in whether it may control anything.

The summary line above the panel is rebuilt from the catalog after a switch
rather than edited in place. Which version runs, its provenance, how well
tested it is and whether it may control anything are all properties of the
artifact now running; the telemetry-only badge in particular differs between
versions of one driver, and it was stale in both directions.

The DOM stub in the tests answered null from querySelector, which let a test
pass while the code it covered did nothing. It resolves properly now, verified
by breaking markRunning and watching the test fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>