sando: harden self-update against self-bricking
sando: seal self-update provenance + bearer-gate reads (Security A+, ultra-fuzz Run 2 deep Phase 1)
sando: fix TUI compile + gate both crates via workspace (ultra-fuzz Run 2 C1)