feat: stop the updater being launched at all

Closing the popup after the fact left it on screen for the 15-20 seconds
between the updater's version check and the Homebrew Channel running its
init.d hooks. That race cannot be won, so remove it.

/usr/sbin/update is launched on demand by ls-hubd via a manifest, and
ls-hubd.conf lists ManifestsVolatileDirectories under /var - writable,
persistent, and how webOS itself ships manifest updates. A manifest there
with the same id and a higher version replaces the read-only one, so drop
in a copy that keeps every role and permission file and only empties
serviceFiles. Nothing on the bus can start the updater after that: no
version check, no alert, nothing to dismiss. Callers get an immediate
"Service does not exist" rather than a hang, and deleting the file undoes it.

Verified on a CX (webOS 5, 04.60.65) across reboots: no update process,
/tmp/var/log/update.log never created, no alert. Previously that log was
55 kB with two server checks and an _gAlertWindowId per boot. Revert puts
the updater back on the bus.

The manifest, its D-Bus service file and the updater binary are all
discovered from ls-hubd.conf rather than hardcoded. The popup-closing
layer stays as a fallback for when this one is off.

Also tried and rejected, now documented in the README: update-related
settings, masking update.service (no writable unit directory), and
breaking its ping through /var/systemd/system/env/update.env - the ping
does fail, but something else on the bus activates the updater anyway.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/index.js

@@ -13,6 +13,11 @@
     '/media/developer/apps/usr/palm/services/org.webosbrew.hbchannel.service/elevate-service';
 
   var TOGGLES = [
+    {
+      key: 'blockUpdater',
+      title: 'Stop the updater running',
+      desc: 'Takes /usr/sbin/update off the bus, so no version check happens and no popup appears'
+    },
     {
       key: 'blockHosts',
       title: 'Block LG update servers',
@@ -21,7 +26,7 @@
     {
       key: 'dismissPopup',
       title: 'Close the update popup',
-      desc: 'The TV asks LG about updates ~20s before homebrew starts, so the popup is closed instead'
+      desc: 'Fallback: closes a popup that appears anyway, e.g. with the updater left running'
     },
     {
       key: 'purgeCache',
@@ -49,6 +54,7 @@
   ];
 
   var config = {
+    blockUpdater: true,
     blockHosts: true,
     dismissPopup: true,
     purgeCache: true,
@@ -224,6 +230,13 @@
     });
 
     row('Service user', status.root ? 'root' : 'uid ' + status.uid + ' (not elevated)');
+    var updater = status.updater || {};
+    if (!updater.found) {
+      row('Update service', 'not present on this TV');
+    } else {
+      row('Update service', (updater.blocked ? 'disabled' : 'launchable') +
+        (updater.running ? ', running now' : ', not running'));
+    }
     row('Hosts entries', status.hosts.blockedDomains + ' / ' + status.hosts.totalDomains +
       (status.hosts.bindMounted ? ' (bind-mounted)' : ''));
     row('Staging folders', stagedDirs ? stagedDirs + ' found' : 'none on this TV');