Updates from Gitea, step 3: install from Gitea, and IRC steps aside for it

A release downloads straight into the inactive slot through the existing
install path: the signature is checked after 160 bytes, before anything
is written, the hash at the end. Tried on the device against the real
server: a download cut short, a flipped byte in the signature and one in
the image are each refused with the running firmware untouched; the real
v0.10.0 installed, restarted, and confirmed itself on Probation.

A TLS connection to Gitea peaks at about 52 KB of heap whether or not the
certificate is verified. With IRC connected (66 KB free) a check left 3 KB
and a download 836 bytes. A check, list or install a person asks for now
makes IRC step aside (holdForUpdate) and come back after: the lowest free
heap during a full download with IRC connected is 38 KB. The daily check
never interrupts IRC; with IRC up it waits. A TLS connection starts with
80 KB free (it was 55).

Debug Builds get test knobs: update probe <host>, update damage cut|flip,
update pretend <version>.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/services/irc_service.cpp

@@ -224,6 +224,14 @@ void IrcService::loop() {
         if (!wanted_) {
             if (open_) close("disconnected");
             status_ = Status::Stopped;
+        } else if (held_) {
+            if (open_) {
+                conn_->print("QUIT :updating\r\n");
+                vTaskDelay(pdMS_TO_TICKS(300));
+                close("paused while the device updates");
+            }
+            status_ = Status::Paused;
+            retryAtMs_ = now;  // back at once when released
         } else if (!wifiUp) {
             if (open_) close(monitoring ? "paused for Wi-Fi monitoring" : "Wi-Fi lost");
             status_ = monitoring ? Status::Paused : Status::WaitingForWifi;