Make `coderai-docker --upgrade` a complete in-image update, not just an app-code
swap:

- Dependency sync: fingerprint the declared deps (requirements.txt + the OCI
  extras) before/after fetch; when they change (or with --force) re-run pip into
  /opt/coderai/python using the same effective set as the image build. Native
  CUDA builds pinned `>=` stay satisfied so pip never clobbers them. A pip
  failure aborts before commit so a half-upgraded image is never produced.
  --no-pip (CODERAI_UPGRADE_SKIP_PIP) refreshes code only.
- System-file refresh: the launchers + nginx/supervisord configs live outside
  /opt/coderai/app, so the code swap alone never updated them (including this
  upgrade script itself). Mirror Dockerfile.update's COPY set, writing each via
  temp+atomic-rename so replacing the running coderai-upgrade is safe.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz