Show trusted stack release metadata

[foxly-it]

What changed

• count and display all five RootGuard runtime services
• add the independent Updater helper to the control-plane panel
• show OCI version, build revision, digest immutability, and metadata completeness
• distinguish mutable tags and local builds from digest-pinned releases
• provide bilingual operator labels for every trust state

Why

The Stack Center previously showed update state for Core and WebApp without their matching runtime evidence. Operators can now see when a container is healthy but its release origin is incomplete or mutable.

Validation

• npm run lint
• npm run build
• backend go test ./...
• live local API verification with five running services
• Docker rebuild and recreation of Core and WebApp

The in-app browser was unavailable in this session, so screenshot-based visual QA could not be performed.