Add A/B updates with boot counting to the appliance image

The image gets a second, empty store slot. systemd-sysupdate (wrapped as
router-update) installs a new version into the slot not in use: both
store partitions, then the UKI with boot counting, verified against a
signed SHA256SUMS. system.build.update holds a version's files.

Counted boots must pass router-healthy (the router's units plus
router.image.healthChecks, each checked on its own) to reach
boot-complete.target; otherwise the box reboots, and once the tries are
used up systemd-boot falls back to the previous version.

checks.image now installs v2 into the empty slot, boots and blesses it,
refuses a tampered update, and rolls a broken v3 back to v2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/image/default.nix

@@ -9,6 +9,8 @@
   imports = [ ../../modules/image ];
 
   networking.hostName = "router";
+  # Bump for every build that is meant to be installed as an update.
+  system.image.version = "1";
   system.stateVersion = "26.11";
 
   # Generic UEFI PC: storage, USB keyboard and NIC drivers in the initrd.