* fix(update): serialize widget upgrades and classify CLI network failures

kpackagetool6 -u deletes the installed package before copying the new one.
Two widget instances (or setup/make update) upgrading at once could leave
no package at all: 2 of 25 overlapping real upgrades removed the widget.
The updater now holds a per-user flock around kpackagetool6 and re-reads
the installed metadata after acquiring it, so a release already installed
by another run reports current instead of upgrading again.

The managed CLI helper reported read timeouts and dropped connections as a
generic error, because urllib wraps only connection setup in URLError, and
a truncated download as a verification failure. Both are now network
failures; IncompleteRead no longer escapes without a JSON result, and the
CLI release check keeps the local version when it occurs.

Documentation: README requirements, development updater notes, CHANGELOG.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(update): share the install lock across launch environments

The lock lived in XDG_RUNTIME_DIR, so a terminal setup or make run without
that variable locked a different file than the panel widget and could still
overlap its kpackagetool6 upgrade. Keep the lock in the data directory that
kpackagetool6 installs into instead. Also release it before finish_setup on
the already-current path, which can prompt or install the CLI for minutes.

Addresses CodeRabbit review on #337.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>