bakery: fix correctness, reliability, and security issues from audit

Track switches now always take effect on `update --all` instead of
silently no-op'ing or permanently refusing on strict semver comparison.
`remove` no longer aborts cleanup on the first failed binary removal,
orphaning the systemd unit. State reads/writes are now lock-protected
and go through fsync'd atomic writes (also fixes a temp-path collision
in binary installs). The index loader falls back to a stale-but-signed
cache instead of hard-failing offline. systemd units now re-fetch on
every update instead of freezing after first install. `doctor` now
flags missing recorded binaries.

Security hardening: path-traversal guard on all index-controlled
filenames, archive extraction now rejects symlink/traversal entries
before tar touches disk, archive temp files use secure unique paths,
post_install hooks are gated behind --no-hooks/confirmation, response
buffering is capped, empty-checksum downloads get a clear error, and
both stable-track CI workflows now hard-fail on a missing signing key
(matching the existing dev/rc guard) instead of silently publishing an
index next to a stale signature. gen-index.sh now publishes the index
and its signature atomically.

Also: bakery install on an already-installed package no longer
silently reinstalls/downgrades, cmd_update exits non-zero for unknown
packages, and the unused toml dependency is removed.

scripts/gen-index.sh

@@ -333,7 +333,8 @@ jq -n \
     --arg generated_at "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
     --argjson packages "${packages_json}" \
     '{version: $version, generated_at: $generated_at, packages: $packages}' \
-    > "${OUT}"
+    > "${OUT}.tmp"
+mv -f "${OUT}.tmp" "${OUT}"
 
 echo "wrote ${OUT}"
 
@@ -360,7 +361,7 @@ if [[ -n "${MINISIGN_SEC_KEY:-}" ]]; then
         echo "ERROR: MINISIGN_SEC_KEY is set but the 'minisign' binary is not installed" >&2
         exit 1
     fi
-    sign_args=(-S -s "${MINISIGN_SEC_KEY}" -m "${OUT}" -x "${OUT}.minisig")
+    sign_args=(-S -s "${MINISIGN_SEC_KEY}" -m "${OUT}" -x "${OUT}.minisig.tmp")
     if [[ -n "${MINISIGN_SEC_KEY_PASSWORD:-}" ]]; then
         MINISIGN_PASSWORD="${MINISIGN_SEC_KEY_PASSWORD}" minisign "${sign_args[@]}" </dev/null
     else
@@ -368,6 +369,7 @@ if [[ -n "${MINISIGN_SEC_KEY:-}" ]]; then
         # normally generated, since there's no human to type a passphrase).
         minisign -W "${sign_args[@]}" </dev/null
     fi
+    mv -f "${OUT}.minisig.tmp" "${OUT}.minisig"
     echo "signed ${OUT} -> ${OUT}.minisig"
 else
     echo "WARNING: MINISIGN_SEC_KEY not set — index.json was NOT signed." >&2