After refreshing the binary, plugins, and daemon, `tracedecay update` now
re-execs a post-update health pass: applies idempotent global-DB schema
migrations, quarantines corrupt branch-meta.json files as
branch-meta.json.corrupt-<timestamp>, purges stale registry rows under the
system temp dir, and summarizes remaining doctor findings. The pass is
failure-tolerant (warnings, never update failure) and skippable with
--no-heal.

branch_meta now owns the one canonical parse used by both load_branch_meta
and the post-update heal quarantine, so schema-corrupt files (valid JSON,
wrong shape) are quarantined instead of warning on every open. Restructures
the health pass into compute/render, fetches the registry once, makes
stale_code_projects borrow with a named StaleRootScope predicate, adds a
shared 0o600-at-create private-open helper in PrivateStoreIo, and documents
the heal-by-default policy. Adds unit + integration tests for the
schema-corrupt quarantine path.

The scheduler gate now loads the run ledger once and threads the records
through the run context, so gate-level and post-gate skip dedup share that
one read and append_skipped_record is a pure append-unless-repeat with no
second I/O pass. Also inlines tokio::time::timeout for the daemon shutdown
deadline (a panic in shutdown_all no longer reads as success) and derives
the session-reflector trust-label representatives from named memory::trust
constants with a drift-guard test.

Moves the update/post-update wiring (plugin refresh, daemon refresh,
subprocess re-exec, health pass) into src/update_cmd.rs following the
*_cmd convention, bringing main.rs to 871 lines. Also promotes the
branch-DB tests' IsolatedEnv into tests/common as the canonical
env-isolation helper.

…20260701

# Conflicts:
#	src/daemon.rs

…20260701

# Conflicts:
#	src/doctor.rs

…20260701

# Conflicts:
#	src/main.rs