Updates from Gitea, step 3: install from Gitea, and IRC steps aside for it

A release downloads straight into the inactive slot through the existing
install path: the signature is checked after 160 bytes, before anything
is written, the hash at the end. Tried on the device against the real
server: a download cut short, a flipped byte in the signature and one in
the image are each refused with the running firmware untouched; the real
v0.10.0 installed, restarted, and confirmed itself on Probation.

A TLS connection to Gitea peaks at about 52 KB of heap whether or not the
certificate is verified. With IRC connected (66 KB free) a check left 3 KB
and a download 836 bytes. A check, list or install a person asks for now
makes IRC step aside (holdForUpdate) and come back after: the lowest free
heap during a full download with IRC connected is 38 KB. The daily check
never interrupts IRC; with IRC up it waits. A TLS connection starts with
80 KB free (it was 55).

Debug Builds get test knobs: update probe <host>, update damage cut|flip,
update pretend <version>.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/services/irc_service.h

@@ -38,6 +38,11 @@ class IrcService : public Service {
     void disconnect();
     bool running() const { return wanted_; }
     bool stoppedByUser() const { return stoppedByUser_; }
+
+    // A TLS connection to Gitea needs more memory than is left beside this one (#6, Q172): the
+    // Update Service asks IRC to step aside while it talks to the server, and to come back after.
+    // Unlike disconnect(), nothing is remembered as "stopped by the user".
+    void holdForUpdate(bool hold) { held_ = hold; }
     Status status() const { return status_; }
 
     // Read or act on the session while holding its lock: withSession([](IrcSession& s) { ... }).
@@ -86,6 +91,7 @@ class IrcService : public Service {
     volatile bool stopRequested_ = false;
     bool quitSent_ = false;  // /quit already queued its QUIT
     volatile bool restart_ = false;
+    volatile bool held_ = false;  // stepping aside for an update
     volatile Status status_ = Status::Stopped;
     bool open_ = false;
     uint32_t retryAtMs_ = 0;