Add guarded model update channel and experiment budgets

[larai-w]

Summary

• add signed model bundle packaging, compatibility and safe reload guardrails
• add local recording and export budgets for experiments
• add updater checks for model entrypoints and artifact size

Verification

• cargo test --workspace
• cargo test -p updater --lib a_model_reload_delivers_sighup_without_restarting_robotd
• cargo test -p updater --lib a_model_bundle_missing_its_onnx_file_is_refused_before_swap
• cargo test -p updater --lib a_model_artifact_must_declare_and_fit_its_budget
• bash scripts/record-lerobot-preflight.sh