feat(ops): add update channels and rollout rings

[typelicious]

What changed

• adds update_check.release_channel with stable vs preview behavior
• adds auto_update.rollout_ring with stable, early, and canary rollout policies
• keeps major upgrades opt-in and surfaces channel/ring context in the API and dashboard

Why

• lets operators separate conservative stable checks from preview release monitoring
• gives scheduled rollouts a smaller and more explicit policy surface than only allow_major true/false

How verified

• python3 -m compileall foundrygate tests
• PYTHONPATH=. ./.venv-check-313/bin/pytest -q
• ./.venv-check-313/bin/ruff check foundrygate/config.py foundrygate/main.py foundrygate/updates.py tests/test_updates.py tests/test_config.py
• ./.venv-check-313/bin/ruff format --check foundrygate/config.py foundrygate/main.py foundrygate/updates.py tests/test_updates.py tests/test_config.py
• /usr/bin/git diff --check