fix(updater): handle busy helpers and same-version repairs

[Kuddev]

Result / 用户结果

A verified same-version installer can repair a previously locked helper while leaving the main executable byte-identical. The updater now accepts that successful repair instead of reporting “Same-version installation did not replace the application binary”. Fixes #258.

Design / 设计边界

Installer success and the expected reported application version remain required. Package size/SHA-256 verification, participant identity, commit authority and snapshot recovery are retained. The installed main hash is recorded as evidence, but is no longer an invalid same-version success condition. Before starting setup, a bounded preflight waits for installed Hook files to become writable. A persistent lock fails before setup can partially replace the installation. The causal note explains the partial-upgrade case and the limits of installed-file verification.

Evidence / 验证依据

• Read the issue's supplied Inno log, which reports successful installation and no required Windows restart.
• scripts/tests/test_update_handoff.ps1: all 12 native process-fixture scenarios passed.
• repair-identical replaces the helper while retaining the main executable bytes and must succeed. upgrade-noop returns setup success but leaves the wrong version and must fail. Cancellation, failed setup, checksum/identity errors and unprepared processes remain covered.
• helper-unlocked verifies transient locks are awaited; helper-held verifies persistent locks prevent setup entirely and recover the original application.
• These are transaction/process fixtures, not a new formal installer release.

Required Review / 必须确认

• Followed the contribution, architecture and project constraints.
• Kept behavior in its owning module and preserved existing compatibility boundaries.
• Architecture check against the PR base passes without budget increases.
• Success/failure regressions and verification limits are described above.
• No application message catalog changes; installer labels use the existing localized custom-message mechanism where applicable.
• No governance rules or server-side protection settings were changed.