Add signed passive runtime updates and independent crash recovery

bin/hydra-update

@@ -0,0 +1,12 @@
+#!/usr/bin/python3 -I
+"""Independent trusted updater launcher; does not import the mutable runtime."""
+from pathlib import Path
+import runpy
+
+path = Path(__file__).resolve()
+if path.parent == Path('/usr/bin'):
+    engine = Path('/usr/lib/hydra-update/engine.py')
+else:
+    # Source checkout only. Installed launchers never fall back to mutable code.
+    engine = path.parent.parent / 'hydra/update_engine.py'
+raise SystemExit(runpy.run_path(str(engine))['main']())

bin/hydra-update-recover

@@ -0,0 +1,8 @@
+#!/usr/bin/python3 -I
+"""Recover without importing any module from the mutable Hydra runtime."""
+from pathlib import Path
+import runpy
+
+path = Path(__file__).resolve()
+engine = Path('/usr/lib/hydra-update/engine.py') if path.parent == Path('/usr/bin') else path.parent.parent / 'hydra/update_engine.py'
+raise SystemExit(runpy.run_path(str(engine))['main'](recovery=True))