AXI-172: Add Desktop Update Control cockpit

[Codename-11]

Summary

• add a bundled, opt-in Update Control Desktop plugin
• expose a narrow plugin SDK facade: detached client/backend status snapshots plus native-updater handoff
• keep checks, confirmation, dirty-tree policy, install, restart, and recovery in Hermes core
• document fork update channels and separate Desktop/backend/build freshness checks

Safety boundary

The plugin cannot apply updates, change update branches, execute shell commands, access raw Electron IPC, or mutate update stores. host.updates.open() delegates to the core-selected active target.

Verification

• focused SDK/update-control regression tests: 51 passed
• Desktop typecheck: passed
• changed-file ESLint and Prettier: passed
• Desktop production build: passed
• Docusaurus production build: passed
• docs diagram lint: 395 files, 0 errors
• independent review: passed, no security or logic findings
• isolated Desktop smoke: plugin enabled, page rendered, snapshots refreshed, native updater opened, no update applied

Full UI run completed 400/403 files and 3,463/3,469 tests. A fresh rerun cleared all five worker-start timeouts. Two unrelated baseline files remain red:

• src/app/skills/index.test.tsx: test DOM/act() leakage across cases
• src/app/shell/hooks/use-statusbar-items.test.tsx: fixture expects +259 carried / 18 behind; production renders +259 carried, 18 behind

Neither file is changed by this PR.

Delivery

Fork-local only. Base: Codename-11/hermes-agent:axiom. No upstream PR.