refactor: make self-update launch readiness explicit

[atomantic]

Summary

Make self-update launch readiness explicit: launchUpdate returns a refusal or a started result with a separate completion promise. The shared handoff awaits launch, observes completion, and preserves existing update errors, socket events, and lock handling. executeUpdate remains a compatible adapter for callers awaiting the full result.

Test plan

• All 100 tests passed across the six focused server suites: self-update launcher, executor, update routes, app updater, preflight parity, and app sockets.
• Fake process handles verify pending completion, refusal, spawn failure, progress, callback compatibility, and later failure reporting. No live update scripts were executed.

Closes #6694