Support controlled package replacement for enrolled executors

[ctfbruce]

Enrolled managed executors previously refused every package version change, even after a clean shutdown. Add dbl service install --replace-package PATH to select a verified full package while preserving the existing executor identity, service account, configuration, database, output and capability profile.

Replacement requires a cleanly stopped, disabled executor and explicit --start=false --enable=false. The selected executor checks database compatibility before the unit changes. The installed record is committed last; repeating the same operation recovers an interrupted unit update, while ordinary install, start and resume refuse a mismatched definition. The new CLI can also select a retained older package when it supports the current state. No schema migration or service restart is implicit.

Ordinary enrolled reinstalls retain their package directory and service account; interrupted counter-mode changes remain retryable. Document stage-only installation, offline backups, explicit activation and rollback without rewinding consumed state. This contributes to #168; signed release publication and the remaining acceptance criteria are separate.

Service race tests and the full CLI race suite pass, including target-path refusal, backward package selection, interruption recovery and same-package capability changes. The CLI test manager now reports its loaded unit path, correcting the enrollment-test failures from the first full CI run. An installed Linux amd64 TLS-enrolled executor passed old-to-new-to-old package replacement, explicit resume and three fresh TEST measurements. Identity, credentials, state bytes, ownership and previous output were preserved; a modified unit was refused. This used unsigned development packages with compatible schemas. All 17 checks pass on 28988587, including required. The installed rehearsal used 130daa0; the only subsequent change is the CLI test fixture, with production code and documentation unchanged.