Make program-changing updates atomic

[bigboateng]

Summary

• add an exact, human-bound installation reconciliation transition for compiled-program changes
• update runtime, launcher, generated skills, program state, and receipts in one journaled transaction with rollback and a shared-installation lock
• expose structured program-delta diagnostics and strengthen updater, doctor, recovery, and generated host-skill contracts

Control boundary

• Slice 1: old-program state plus requested update and authority resolves to exact update admission or a fingerprint-bound acceptance requirement
• Slice 2: accepted reconciliation plus old and candidate identities commits atomically to a healthy new installation or recovers a coherent healthy old installation
• acceptance authorizes only the exact checksum- and program-delta-bound update; it grants no repository, provider, publication, or merge authority

Verification

• repository Python contract suite
• complete 10-shard Go test suite
• Go race tests
• Go vet
• Go build
• shell syntax check
• release-note policy preflight
• generated artifact validation
• diff whitespace check

Release note

• release-notes/2026-08-11-atomic-program-update-reconciliation.md