Undo without a network: keep the previous release until the next update #297

Deferred from #287 (Anders, 8 Oct). Release: after 0.8.0.

Today Undo (elastos update --rollback-to <previous head>) works online: it fetches the previous release's changed parts by CID from the trusted source, which keeps every published release pinned (proven on Mac and Jetson, 8 Oct). Nothing is kept locally after a successful update, which matches #108's retention rule (active set, one staged set, one rollback during the update window).

Goal: Undo to the previous release works without a network.

Known facts (from the 8 Oct code map, develop 34b2e5c):

• A System update copies every replaced file (install_transaction.rs rollback scratch for the five release files; install_transaction/support.rs rollback-N for component trees) and deletes the copy after success (cleanup, called from commit_with, finish_restart and recovery).
• A Terminal update refreshes support components in place, outside the transaction (setup.rs ~3134-3212 via update.rs ~1647), so its copy holds only the five release files.
• Startup recovery treats any leftover stage/rollback scratch as an interrupted update, so a kept copy needs its own location and record.
• sources.json must not be restored byte for byte (re-trust and source edits).

Done means

• After a successful update (System or Terminal), one verified copy of the previous release stays until the next update starts; disk use is counted in the free-space check.
• Undo restores that copy offline after checking it against the previous signed release, keeps data written after the update, and refuses a changed copy without changing anything.
• Startup recovery does not mistake the kept copy for an interrupted update.
• Tests for each, and a real offline Undo on Mac, Linux and Jetson.