bug(cli-updates): Update Now that cannot start leaves an undismissable 'Updating' row #1425

Expected behavior

When Update Now (or an automatic update) cannot start, the CLI update banner says so and stays dismissable.

Actual behavior

• CliUpdateOrchestrator.runUpdate publishes updating first, then awaits openLog, which mkdirs STATE_DIR/cli-update-logs.
• If that rejects (EACCES on a read-only state dir, or ENOSPC), nothing catches it after updating was published. The snapshot stays updating and the banner row cannot be dismissed.
• The renderer's void window.api.cliUpdatesUpdateNow(cli) also drops the IPC rejection, so nothing is said.

Found by the review of #1423 (reviewer b, temp/review-1423/report-b.md). A temporary renderer probe with a rejecting cliUpdatesUpdateNow showed no alert.

Root cause

• src/main/setup/cliUpdateOrchestrator.ts runUpdate: openLog runs outside any catch after the updating publish.
• src/renderer/src/features/cli-updates/CliUpdateBanner.tsx: the Update Now actions are fire-and-forget.

Fix direction

• A failure before the command runs must leave updating. That needs a failed shape without a log (for example a logPath: string | null, or a could-not-start reason). It touches @shared/types/cliUpdate, the orchestrator and the banner.
• The Update Now action can use the banner's new action-result contract from fix(cli-updates): View Log says when the log did not open (#1250 row 10) #1423 (onClick answers, failureText).

Related: #1250 (C3 silent failures), #1423.