fix: surface update check fetch errors

[ai-ag2026]

Summary

• surface git fetch failures from the WebUI self-update check instead of reporting green “Up to date”
• keep locally-known release gaps visible when a tag fetch fails after tags are already present
• add regression coverage for stale/failing update checks and the manual Settings status path

Root cause

The update checker ran git fetch origin --quiet --tags and returned behind: 0 whenever the fetch failed. The Settings UI only checked whether behind > 0, so an error payload like {behind: 0, error: "fetch failed"} rendered as “Up to date ✓”.

A real failure mode is a local tag that differs from the remote tag (would clobber existing tag ...): the checkout can already know about newer release tags, but the fetch exits non-zero and the current UI masks the problem.

Related reconnaissance

• Searched open PRs/issues for update-check/fetch/tag/up-to-date overlap; no topical duplicate found.
• Current origin/master still returns behind: 0 on update-check fetch failures.
• Some open PRs touch shared frontend files, but none target this update-check error path.

Test plan

• python3 -m pytest tests/test_updates.py tests/test_update_check_ui.py -q -o addopts=
• python3 -m pytest tests/test_updates.py tests/test_update_check_ui.py tests/test_regressions.py -q -o addopts=
• LC_ALL=C LANG=C TZ=UTC python3 -m pytest -q -o addopts=
• python3 -m compileall -q api tests
• node --check static/ui.js
• node --check static/panels.js
• git diff --check

Note: the unsanitized local full-suite run hit an unrelated locale-sensitive timestamp assertion (10:00 AM expected while Node formatted German 29. März, 10:00). The same full suite passed under neutral LC_ALL=C LANG=C TZ=UTC.

[nesquena-hermes]

Shipped in v0.51.107 via release/stage-400 (#2725) — squash-merged so the source branch doesn't auto-close on the keyword.

Thanks for the contribution! Your authorship is preserved via the Co-authored-by trailer on the merged commit.