Add install checkpoint/resume and DDSS workflows

Introduce install checkpoint support and resume logic for updates, plus related locking and validation. Adds InstallCheckpoint model, AppJsonContext serialization, and UpdatePaths helpers for deployment lock, apply-in-progress lock and install-checkpoint path. UpdateEngineService gains checkpoint load/save/delete, incoming-state validation, resume logic for PLONDS and legacy updates, apply lock handling, and safer cleanup; ApplyPendingPlondsUpdateAsync and ApplyPendingUpdate flow updated accordingly. Add DeploymentLock contract and extend UpdateState with pause/resume/cancel helpers. Tests updated to cover stale/valid checkpoint resume and legacy/PLONDS flows. CI: enhance ddss-publish to detect release channel, validate S3 assets, prepare and atomically publish channel pointer; add ddss-rollback workflow to publish rollbacks; adjust plonds-build concurrency and release events.

LanMountainDesktop.Shared.Contracts/Update/DeploymentLock.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace LanMountainDesktop.Shared.Contracts.Update;
+
+public sealed record DeploymentLock(
+    int SchemaVersion,
+    string Kind,
+    string TargetVersion,
+    string PayloadPath,
+    string? PayloadSha256,
+    DateTimeOffset CreatedAtUtc);

LanMountainDesktop.Shared.Contracts/Update/UpdatePaths.cs

@@ -54,8 +54,20 @@ public static class UpdatePaths
     public static string GetPlondsSignaturePath(string launcherRoot)
         => Path.Combine(GetIncomingDirectory(launcherRoot), GetPlondsSignatureName());
 
-    public static string GetPlondsUpdateMetadataPath(string launcherRoot)
-        => Path.Combine(GetIncomingDirectory(launcherRoot), GetPlondsUpdateMetadataName());
+    public static string GetDeploymentLockName() => "deployment.lock";
+
+    public static string GetDeploymentLockPath(string launcherRoot)
+        => Path.Combine(GetIncomingDirectory(launcherRoot), GetDeploymentLockName());
+
+    public static string GetApplyInProgressLockName() => "apply-in-progress.lock";
+
+    public static string GetApplyInProgressLockPath(string launcherRoot)
+        => Path.Combine(GetIncomingDirectory(launcherRoot), GetApplyInProgressLockName());
+
+    public static string GetInstallCheckpointName() => "install-checkpoint.json";
+
+    public static string GetInstallCheckpointPath(string launcherRoot)
+        => Path.Combine(GetIncomingDirectory(launcherRoot), GetInstallCheckpointName());
 
     public static string GetDownloadMarkerContent(string manifestSha256, string targetVersion, int objectCount)
     {

LanMountainDesktop.Shared.Contracts/Update/UpdateState.cs

@@ -6,8 +6,10 @@ public enum UpdatePhase
     Checking,
     Checked,
     Downloading,
+    PausedDownloading,
     Downloaded,
     Installing,
+    PausedInstalling,
     Installed,
     Verifying,
     Completed,
@@ -64,9 +66,8 @@ public static class UpdatePhaseExtensions
         phase is UpdatePhase.Completed or UpdatePhase.Failed or UpdatePhase.RolledBack;
 
     public static bool IsBusy(this UpdatePhase phase) =>
-        phase is not (UpdatePhase.Idle or UpdatePhase.Checked or UpdatePhase.Downloaded
-            or UpdatePhase.Installed or UpdatePhase.Completed or UpdatePhase.Failed
-            or UpdatePhase.RolledBack);
+        phase is UpdatePhase.Checking or UpdatePhase.Downloading or UpdatePhase.Installing
+            or UpdatePhase.Verifying or UpdatePhase.Recovering or UpdatePhase.RollingBack;
 
     public static bool CanCheck(this UpdatePhase phase) =>
         phase is UpdatePhase.Idle or UpdatePhase.Checked or UpdatePhase.Downloaded
@@ -80,4 +81,16 @@ public static class UpdatePhaseExtensions
 
     public static bool CanRollback(this UpdatePhase phase) =>
         phase is UpdatePhase.Failed;
+
+    public static bool CanPause(this UpdatePhase phase) =>
+        phase is UpdatePhase.Downloading;
+
+    public static bool CanResume(this UpdatePhase phase) =>
+        phase is UpdatePhase.PausedDownloading or UpdatePhase.PausedInstalling;
+
+    public static bool CanCancel(this UpdatePhase phase) =>
+        phase.IsBusy() || phase.CanResume();
+
+    public static bool IsPaused(this UpdatePhase phase) =>
+        phase is UpdatePhase.PausedDownloading or UpdatePhase.PausedInstalling;
 }