Bind app update conflicts to a whole-tree policy

[hamzamerzic]

Summary

• require the owner's whole-tree policy before the resolver agent starts
• persist both the selected policy and the reviewed preserve-local tree identity in the pending receipt
• show and bind the complete preserve-local diff, rejecting source drift before and during installer replay
• route exact-upstream replacement through the existing journaled installer path, including removal of local-only tracked source
• simplify the resolver instructions around one policy, one whole-tree review, and one finalize command

Closes #148.

Coordination

Land the companion App Store policy-choice change first. This platform change then requires that policy on the resolver-open request.

Tests

• scripts/test.sh --fast
• scripts/wt-pytest.sh backend/tests/test_apps_install.py -q --tb=short -k 'conflict or resolve or pending_update'
• full backend/tests/test_apps_install.py suite