Updates: offer an RPM only to a copy rpm owns, and never read an unknown version as older

On a distribution without rpm, a locally built package that mirrors the spec puts the nightly tree
at /opt/DodoSSH.Nightly, and that path was the whole test for "the RPM installed this". The channel
then asked rpm for the installed version, got nothing because there is no rpm, read the silence as
"0", and offered every nightly as newer, fetching a 56 MB RPM into the profile directory that the
machine could never install, every six hours.

UpdateChannels.LinuxChannel still checks the path first, then asks rpm through the new
LinuxUpdateChannel.ForInstall. A copy rpm has no record of gets an UnavailableUpdateChannel that
says it was installed outside the dodossh-nightly (or dodossh) RPM and should be updated with the
package manager that installed it. UnavailableUpdateChannel gains an optional Reason for that,
UpdateViewModel exposes it as UnsupportedReason, and the desktop preferences page shows it in place
of the sentence about checkouts and unzipped copies. That costs one rpm launch at start, and only
where the path already matched.

CheckAsync no longer falls back to "0". If rpm stops answering after composition, the check throws
instead, so CHECK NOW reports it and the timer stays quiet, and nothing is offered or fetched. The
comment that called the fallback a deliberate choice is replaced with the reason it was wrong.

LinuxUpdateChannelTests: an unknown installed version throws and downloads nothing (replacing the
test that asserted the old behaviour), a copy rpm does not own is unavailable and says why, and a
copy rpm owns gets the channel. The newer, equal and older comparisons were already covered.
UpdateFlowTests covers the reason reaching the view model. Manual check 19.13.

App tests 744/752 with 8 skips, layout tests 202/203 with 1 skip; the full solution passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/DodoSSH.Client.App.Tests/LinuxUpdateChannelTests.cs

@@ -86,19 +86,86 @@ public sealed class LinuxUpdateChannelTests : IDisposable
     }
 
     /// <summary>
-    /// A machine that cannot say what it has treats everything as newer.
+    /// A machine that cannot say what it has is told so, and is offered nothing.
     /// </summary>
     /// <remarks>
-    /// The wrong way to fail, chosen deliberately and for the reason the android channel gives: the cost is
-    /// an install the package manager declines, and the cost of the other direction is a security fix that
-    /// never arrives.
+    /// This used to read the silence as <c>0</c> and offer everything, on the argument that the cost was
+    /// an install the package manager declined. On a machine with no rpm at all — a pacman package of the
+    /// same tree at the same path — that was every nightly, every six hours, as a 56 MB download nothing
+    /// could install. Unknown is not older.
     /// </remarks>
     [Fact]
-    public async Task AnUnknownInstalledVersionTreatsEverythingAsNewer()
+    public async Task AnUnknownInstalledVersionThrowsRatherThanOfferingAnything()
     {
-        var channel = Channel(RandomNumberGenerator.GetBytes(16), published: "0.0.1~alpha.0.1-1", installed: null);
+        var handed = new List<string>();
+        var channel = Channel(
+            RandomNumberGenerator.GetBytes(16),
+            published: "0.0.1~alpha.0.200-1",
+            installed: null,
+            handToInstaller: handed.Add);
 
-        (await channel.CheckAsync(Token)).ShouldNotBeNull();
+        await Should.ThrowAsync<InvalidOperationException>(async () => await channel.CheckAsync(Token));
+
+        await Should.ThrowAsync<InvalidOperationException>(
+            async () => await channel.DownloadAsync(
+                new DodoSSH.Client.Session.AvailableUpdate("0.0.1-alpha.0.200"),
+                new Progress<int>(),
+                Token));
+
+        handed.ShouldBeEmpty();
+        Directory.Exists(Path.Combine(directory, "updates")).ShouldBeFalse();
+    }
+
+    /// <summary>
+    /// A copy rpm does not own gets no channel at all, and a sentence saying whose it is to update.
+    /// </summary>
+    /// <remarks>
+    /// The case that matters: the right path and no rpm — a locally built pacman package that mirrors the
+    /// spec. No binary and no such package both arrive here as null.
+    /// </remarks>
+    [Fact]
+    public void ACopyRpmDoesNotOwn_IsUnavailableAndSaysWhy()
+    {
+        var asked = new List<string>();
+
+        var updates = LinuxUpdateChannel.ForInstall(
+            "nightly",
+            package =>
+            {
+                asked.Add(package);
+
+                return null;
+            },
+            () => throw new InvalidOperationException("Built a channel for a copy rpm does not own."));
+
+        asked.ShouldBe(["dodossh-nightly"]);
+        updates.IsSupported.ShouldBeFalse();
+
+        var reason = updates.ShouldBeOfType<DodoSSH.Client.Session.UnavailableUpdateChannel>().Reason;
+
+        reason.ShouldNotBeNull();
+        reason.ShouldContain("outside the dodossh-nightly RPM");
+        reason.ShouldContain("package manager that installed it");
+    }
+
+    [Fact]
+    public void ACopyRpmOwns_GetsTheChannel()
+    {
+        var asked = new List<string>();
+        var owned = new FakeUpdateChannel();
+
+        var updates = LinuxUpdateChannel.ForInstall(
+            "release",
+            package =>
+            {
+                asked.Add(package);
+
+                return "0.0.1-1";
+            },
+            () => owned);
+
+        asked.ShouldBe(["dodossh"]);
+        updates.ShouldBeSameAs(owned);
     }
 
     [Fact]