fix(system-update): report and resolve updates truthfully

[verlyn13]

What changed

• make AI-channel check summaries count actual version mismatches
• let stable npm globals resolve the newest release eligible under the configured cooldown
• preserve exact inventory targets for post-install drift reporting
• document both incidents and add regression coverage
• refresh the verified MCP service-account and telemetry facts
• add a dated restart handoff with Git, updater, identity-drift, and operator-boundary evidence

Why

The AI check summary counted successful registry lookups as available updates. Separately, the stable npm lane passed an exact release inside --min-release-age, causing npm to return ETARGET instead of selecting the newest eligible Wrangler release. The repository index also carried a stale service-account status and telemetry measurement, and there was no single restart-oriented entry point for a fresh agent.

Impact

Read-only checks now distinguish current channels from outdated ones. Stable npm updates retain the two-day safety window while completing successfully and disclosing when the installed release trails the inventory target. The AI channel cooldown and install-script identity gate are unchanged. The new handoff preserves external clone drift and operator-only work as evidence rather than implicit authorization.

Validation

• tests/system-update/run.sh — 156 passed, 0 failed
• live system-update --only npm-globals --no-plugins — Wrangler 4.118.0 to eligible 4.119.0, zero failures
• full system-update --check — all steps successful in 36 seconds; all three AI channels current
• scripts/validate-repo.sh — PASS after the final handoff
• chezmoi apply --dry-run --force — PASS after the final handoff

Remaining boundaries

• Wrangler 4.120.0 remains held by the configured cooldown
• ng-doctor identity still reports two failures across three external clones; this PR does not mutate them
• MCP telemetry retention and VS Code/posture operator decisions remain explicitly unapproved work