* fix(updater): verify the previous CLI before rollback

Rollback trusted installation receipts without probing the retained executable, so a damaged or non-executable previous copy could replace a working CLI. Reuse the bounded offline version probe before changing activation state.

Update README, usage, development documentation, and Unreleased notes. No parity TODO or translation changes are required. Verified make check (local optional KDE skips and partial QML type checks) and make package.

* fix(updater): compare the installed widget from checkout runs

Both the initial comparison and the post-lock recheck used checkout metadata, allowing downgrades, redundant reinstalls, and skipped upgrades. Read and validate the actual per-user package for installation decisions.

Add checkout and concurrent-update regressions, keep integrity fixtures on an older installed version, and update README, usage, development, and Unreleased notes. No parity TODO or translation impact.