Preserve market settings and exact update rollback

[WSL043]

Summary

• preserve the user's selected market channel across plugin toggle, group, removal, and restore writes
• make every rejected npm/GitHub update and deferred compatibility rollback restore the captured exact prior version or commit
• advance the independently reviewed dsh-market basis to v1.39.0 and the vendored market to 0.1.0-beta.9

TDD evidence

• observed the market-state test fail with actual undefined, expected beta
• observed the update-route contract fail because several rejection paths still called the broad manifest reinstall rollback
• focused red/green tests now pass

Verification

• market + distribution suites: 61/61
• full repository suite: 387/387
• scripts/verify-lock.mjs app/package-lock.json upstream.lock.json
• vendored server/client bundles rebuilt
• staged diff and secret scan passed

Fixes #67