Remove all alternate update paths — fleet redeploy is release + upgrade all

Killed:
- rebuild_and_restart (in-container cargo self-compile): the MCP tool,
  the `rebuild` chat command in all four transports, the web-ui bot
  command, and the underlying function. This was the path that caused
  the exec() deadlocks.
- upgrade_sled gateway MCP tool: second entry point to sled upgrades,
  defaulted to serving the gateway's own macOS binary to Linux sleds.
- GET /api/huskies-binary (both sled and gateway route trees): served
  current_exe(), wrong platform when the gateway is macOS. Superseded
  by /api/artifacts/ which now also serves on the gateway route tree.
- `huskies upgrade` CLI subcommand and --source flag: third way of
  doing the same download-and-replace. Escape hatch for a bricked sled
  is `docker cp` + restart.

Kept, distinct jobs: `project-rebuild` (container/image updates),
`rebuild gateway` + script/local-release (gateway self-update).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019fHdm92yjvguPi2LiXfLB9

server/src/agents/pool/pipeline/merge/time.rs

@@ -2,10 +2,10 @@
 
 /// Wall-clock time captured the first time this server process touches the
 /// merge subsystem. Used to detect merge_jobs left over from a previous
-/// server instance: a re-exec on `rebuild_and_restart` keeps the same PID,
-/// so PID alone cannot distinguish "current" vs "previous" server. This
-/// timestamp is fresh per-process (the static is reset by execve) and is
-/// the source of truth for stale-merge detection.
+/// server instance: PIDs can collide across restarts (PID 1 in a container
+/// is always the server), so PID alone cannot distinguish "current" vs
+/// "previous" server. This timestamp is fresh per-process and is the source
+/// of truth for stale-merge detection.
 static SERVER_START_TIME: std::sync::OnceLock<f64> = std::sync::OnceLock::new();
 
 /// Return this server process's start time (lazily captured on first call).