fix(ota): isolate updates in persistent workspaces (#863)

* fix(ota): isolate updates in persistent workspaces

Stage online and offline update archives under /root/.kvmcache/nanokvm-update-* and validate storage, manifests, and archive contents before changing the installed application.

* fix(ota): harden storage safety and release gates

Preserve the last rollback backup when update storage is insufficient, and verify the actual application mount point before installation.

Move the shared transfer sentinel from /tmp to /run, enforce device package limits in release verification, and run that verification in package CI.

.github/workflows/package.yml

@@ -251,6 +251,11 @@ jobs:
             echo "sha512_base64=${SHA512_BASE64}"
           } > build/release/BUILD_INFO.txt
 
+      - name: Verify release assets
+        run: |
+          ./scripts/verify-release-assets.sh \
+            build/release "${{ steps.version.outputs.version }}"
+
       - name: Summary
         env:
           VERSION: ${{ steps.version.outputs.version }}