Upgrade risk explainers

[itzptk]

Summary

• Adds a Smart Upgrade review surface with per-package kind, versions, risk, reason, pinned/user-excluded status, and selected package count.
• Adds run-only include/exclude overrides so users can change the current Smart Upgrade run without mutating Homebrew pins or saved exclusions.
• Supports include-only runs for pinned/user-excluded packages and blocks empty effective selections.
• Preserves pinned state in pre-upgrade snapshots for temporary Homebrew-pinned overrides.

Fixes #10

Verification

• git diff --check
• npm run test:node -- electron/services/homebrew-service.test.ts --testNamePattern "temporary include|include-only" — 2 passed / 67 skipped
• npm run test -- --watch=false --include src/shared/contracts.spec.ts --include src/app/components/ux/smart-upgrade-dialog/smart-upgrade-dialog.component.spec.ts --include src/app/features/updates/updates-view/updates-view.component.spec.ts — 46 passed
• npm run test -- --watch=false --include src/app/components/ux/smart-upgrade-dialog/smart-upgrade-dialog.component.spec.ts — 4 passed
• npm run test:all — Angular 114 files / 258 tests passed; Node 15 files / 118 tests passed
• npm run build — Angular production build and Electron tsup build succeeded

Review

• Independent pre-commit review: passed
• Earlier review findings fixed: include-only run support, empty effective-selection guard, and pinned snapshot metadata