Harden workspace sync quarantine and updater recovery (#6)

tests/update-service.test.mjs

@@ -268,6 +268,15 @@ test("PowerShell update helper starts with param and has no BOM or stray leading
   assert.match(text, /npm ci --no-audit --no-fund/);
   assert.match(text, /package-lock\.json/);
   assert.doesNotMatch(text, /Get-Command npm\.cmd/);
+  assert.match(text, /Integrated source update refuses to overwrite a Git working tree/);
+  assert.ok(
+    text.indexOf("Handshake-only verification completed successfully") <
+      text.indexOf("Integrated source update refuses to overwrite a Git working tree"),
+  );
+  assert.ok(
+    text.indexOf("$actualHash = Get-Sha256") <
+      text.indexOf("Source update preflight passed"),
+  );
   assert.ok(
     text.indexOf('Write-UpdateState -State "success"') <
       text.indexOf("Start-ForgeFlow -WorkingDirectory $SourcePath"),
@@ -764,4 +773,15 @@ test("binary update helper verifies, waits, applies and records restart state",
     );
   }
   assert.doesNotMatch(helper, /Get-FileHash/);
+  assert.match(helper, /function Start-ForgeFlowAndVerify/);
+  assert.match(helper, /Start-Sleep -Milliseconds 1500/);
+  assert.match(helper, /Updated portable executable failed its restart probe/);
+  assert.ok(
+    helper.indexOf("$actualSha256 = Get-Sha256") <
+      helper.indexOf("Binary preflight passed"),
+  );
+  assert.ok(
+    helper.indexOf("Binary preflight passed") <
+      helper.indexOf('Write-UpdateState -State "waiting-for-exit"'),
+  );
 });