Implement verified self-update flow

[parthashirolkar]

Summary

• add release asset checksum verification and extracted binary pre-replacement smoke test
• replace the update target with backup/rollback handling and post-replacement smoke test
• wire default isobox update to perform the verified install flow while preserving --check

Closes #60
Closes #61

Checks

• make fmt
• make lint
• make test
• make build

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}