The app packages refuse to install over a newer copy, and the launcher's own guard refused
every downgrade. A version chosen by name below the installed one now:
1. finds the installed version's published release and downloads and checks both packages
before anything changes (without them, nothing is removed);
2. removes the installed copy;
3. installs the chosen version in the same folder and context, and reinstalls the previous
version if that fails or permission is refused.
A feed still can't send an app back. Other kinds of install refuse a downgrade plainly.
ReleaseSource::chosen's default now answers pins and nightly from versions(), so a pinned
app's check reports its pinned release and a newer one is never offered as an update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>