Use active custom script if available

[cdcme]

Related issue: Resolves #48301

When the auto-update cron downloads a new Fleet-maintained app version, it now carries forward the previously-active install/uninstall scripts when they were customized (e.g. via GitOps), instead of overwriting them with the manifest defaults. Customization is detected per-script by comparing the active scripts against the manifest (the uninstall script is compared against the manifest template substituted with the active version's package IDs, since it's version-specific). When the active scripts match the manifest, the new version's manifest scripts are used as before.

Checklist for submitter

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[codecov]

Codecov Report

❌ Patch coverage is 73.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.45%. Comparing base (d8c4faa) to head (5d4ab81).
⚠️ Report is 3 commits behind head on feat/38504-auto-update-pin-rollback-fma.

Files with missing lines	Patch %	Lines
ee/server/service/maintained_apps_auto_update.go	73.33%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@                             Coverage Diff                             @@
##           feat/38504-auto-update-pin-rollback-fma   #48350      +/-   ##
===========================================================================
+ Coverage                                    67.36%   67.45%   +0.09%     
===========================================================================
  Files                                         3668     3668              
  Lines                                       232220   232240      +20     
  Branches                                     12401    12401              
===========================================================================
+ Hits                                        156428   156661     +233     
+ Misses                                       61790    61536     -254     
- Partials                                     14002    14043      +41     

Flag	Coverage Δ
backend	69.00% <73.33%> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.