OTA updates with rollback: signed image manifests on a pantry channel, A/B root + kernel slots via the Pi 5 bootloader `tryboot`, health check → commit or automatic rollback, Settings UI

Epic: #113 · Milestone: MC9 — Ship

Why

"Install and forget" is a MASTER_PLAN pillar (§1, §9 E). The Pi 5 bootloader's tryboot flag lets us boot the new slot once; if the shell does not mark it healthy (watchdog + health check), the next reset returns to the old slot — no homefs snapshots required for v1 (S4 stays on its own track).

Tasks

• Channel format: manifest.json (version, slots, hashes, Ed25519 signature — S5), delta-free full images per slot at first (bsdiff-style deltas later), served over HTTPS from pantry's CDN (~/Code/pantry infra) or any static host.
• Updater in the shell: check (daily + manual), download to the inactive slot with resume, verify signature + hash, write tryboot request, reboot at a quiet time (not during playback, user-confirmable).
• Health check on boot: shell reaches the home screen + audio/display OK within 60 s → commit (swap autoboot.txt slot); else watchdog reboot → old slot; failure surfaced in Settings with the log.
• Config/data migration hooks; settings schema versions; never touch the data partition on rollback.
• HIL gate ota-roundtrip: install a deliberately broken image → auto-rollback; install a good image → commit; both scripted from the Mac.

Acceptance

ota-roundtrip passes on the rig; a user can update and roll back from Settings.

Size: L · Depends on: #108, #107, #64 (watchdog), #69 · Blocks: v1