feat(providers): merge update notices, Update all with progress

[Tryanks]

Summary

Provider update checks now report as one round, and updating is one sequential run that the runtime owns and every client renders.

 check_provider_versions
-  per provider: Notice(UpdateAvailable)           # one toast each
+  round of checks → Toast(ProviderUpdatesAvailable { updates })
+    action "Update all" for entries whose plan is automatic

-Command::UpdateProvider { provider }
+Command::UpdateProviders { providers }
+  run sequentially (package managers hold locks)
+  Toast(ProviderUpdateStarted) → ProviderUpdateProgress (same toast id) → ProviderUpdateFinished
+  ProvidersStatus.update_run { total, completed, current, failed }

 Settings → Providers header
   checked X ago · Tcode update · Add agent
+  Update all (shown when an automatic update exists; loading during a run)
   refresh
+ progress row: "Updating Codex… 1/3" + Progress bar (while a run is active)

Toasts carrying an action no longer auto-dismiss. The git retry action and the new Update-all action share one RuntimeToastAction enum. RuntimeNotice::{UpdateAvailable, UpdatingProvider, UpdateDone} and RuntimeError::{UpdateUnknown, UpdateFailed} are removed; failures are folded into the run result. Protocol version stays 9 (unreleased); its note records the change.

Evidence

• Before: four providers with updates produced four separate success notices with no action; each update ran independently and could collide.
  After: version_round_merges_new_updates_and_finishes_after_stale_completion drives complete_version_check for two new updates plus one stale completion and gets exactly one toast listing both; merged_provider_toast_offers_only_automatic_updates_in_both_locales checks the Update-all action is offered only for automatic entries; provider_update_command_and_toasts_have_literal_wire_contracts pins the JSON shape.
• Checks run in the worktree: cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo nextest run --workspace --locked (908 passed, 11 skipped).
• Visual: Settings → Providers inspected at 1200×800 and 600×800 in light and dark. No provider on this machine had an update, so the Update-all button, progress row and a real package-manager run were not seen live; the idle state hides them correctly.

Merge Danger

Door: two-way

Revert restores the per-provider notices; nothing persisted changes.

Blast Radius: protocol

A client and host on different sides of this change disagree on UpdateProvider and the removed notice variants, but the wire already changed in unreleased version 9. The live update path (sequential command execution, success and failure toasts) is unverified on a real outdated CLI.