fix(deploy): reconcile update version metadata

[osolmaz]

Summary

mlclaw update changed the hosted Space image but left the local manifest and canonical desired state on the old version.
This change makes a successful update persist the same effective image everywhere, so later commands see the deployment that is actually running.
It also prepares patch release 0.4.9 through the synchronized release configuration.

What Changed

Managed Space updates now finish through the existing deployment reconciliation path after the remote update passes its doctor check.
Canonical-template updates keep their existing behavior.

• Persist the effective prebuilt, bundled, or explicitly selected runtime image.
• Update canonical desired state, local manifest generation, and local secret metadata under the deployment lease.
• Add regression coverage for default, bundled, and explicit runtime image updates.
• Synchronize package, lockfile, generated config, Docker default, and tracked bundle for 0.4.9.

Testing

The focused update tests and the complete local quality gate pass.

• npx vitest run test/mlclaw.cli.test.ts test/mlclaw.bundle.test.ts
• npm run check
• 314 tests passed, 2 environment-dependent tests skipped
• 97.5% statement coverage
• Slophammer: no findings

Risks

The change is limited to managed Space updates after remote validation succeeds.
A failure before reconciliation still leaves local metadata untouched, so rerunning the command remains safe.