[gmmcosta15]

Description

• Feature
• Bug Fix
• Code Refactor
• Documentation

Keep the update overlay up until install-updater and the daemon restart finish (capped at 180s), and add a hermetic end-to-end updater integration suite.

Changes

• Daemon stays busy while install-updater runs (deploy flag + BlocksScreen-deploy.path), polled every 1s, capped at 180s so a hung deploy never locks the screen
• Restarted daemon resumes the hold silently at init; first status emit waits for the boot pass
• UI keeps the update overlay through daemon_restarting instead of dropping it mid-update
• tests/integration/updater/: hermetic end-to-end suite (real git remotes, faked systemctl/sudo/apt/pip), 29 tests covering update, rollback, branch switch, deploy handoff, boot reconcile, provisioning, cancel
• make test-integration runs tests/integration/; the NetworkManager suite moved to make test-integration-nm

Motivation

After an update that touched the installer, the overlay dropped while install-updater was still running, so the screen unlocked and briefly showed a provisioning step mid-update.

Tests

• Overlay hold mutation-checked: disabling it fails test_install_update_holds_overlay_until_deploy_finishes

[RobeMartins]

LGTM