system/nxpkg: Complete the package lifecycle and command line.

[aviralgarg05]

Note: Please adhere to Contributing Guidelines.

Depends-On: /pull/3719

Summary

Install wrote the current and previous pointer files, and removed the
payload of a pruned version, around the database save rather than after it.
A failure in between left the database naming a version whose files were
already gone. Reinstalling a version that was already present treated its
directory as newly created, so a failed reinstall deleted a working
install. Uninstall and rollback took only the database lock, which left
another install free to work on the same package at the same time.

The database is now committed first, and only then are pointers refreshed
or files deleted. A crash can therefore strand files that are reclaimable,
but never leaves the database pointing at a payload that is gone. Uninstall
and rollback take the per-package lock as well, and install picks up state
left behind by an earlier attempt that was interrupted.

Only install, list and available were reachable from the shell, so a
package could be put on a device but never updated, rolled back or removed.
sync, update, remove and rollback are now wired up, and the CLI
reports the errno the library returns rather than a plain failure.

This is the last of four parts of #3642, which was one commit covering
several unrelated changes.

Impact

• New feature: YES, update, rollback and remove become usable.
• User adaptation: NO.
• Build: NO.
• Hardware: NO.
• Documentation: The companion documentation is Documentation: Update nxpkg and add nxstore guide. nuttx#18875.
• Security: NO new boundary. The ordering change removes a way to lose a
  payload the database still refers to.
• Compatibility: An existing installed database is read as before.

Testing

Build host: macOS 26.5, arm64, xtensa-esp-elf-gcc 14.2.0
(esp-14.2.0_20251107).

Target: Xtensa / ESP32-S3, Waveshare ESP32-S3-Touch-LCD-7.

• nxstyle, tools/checkpatch.sh, codespell and git diff --check on
  every changed file
• all system/nxpkg sources compiled for the target with this commit
  applied on top of system/nxpkg: Fetch the catalog and artifacts over the network. #3719

On the target, against a repository on the SD card, the following were
exercised: install, update to a second version, rollback to the first,
remove, a package lock held against a second install returning -EBUSY, a
lock reclaimed from an exited owner and from an earlier boot, and an
artifact whose SHA-256 did not match, which left no database entry, version
directory, lock or transaction file behind.

This commit does not build on master alone because it uses declarations
and helpers added by the three parts before it; the Depends-On line above
lets CI apply those first.

PR verification Self-Check

• This PR introduces one focused change.
• I have updated all required description fields above.
• I have reviewed and signed every commit.
• This PR adheres to the current contribution and coding guidelines.
• My PR is still work in progress.
• My PR is ready for review and can be safely merged.

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Fetch the catalog and artifacts over the network. #3719 @ 24db760

CI run: https://github.com/apache/nuttx-apps/actions/runs/31526679208

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Fetch the catalog and artifacts over the network. #3719 @ 022f5d5

CI run: https://github.com/apache/nuttx-apps/actions/runs/31814249024

[xiaoxiang781216]

@aviralgarg05 please squash into one patch.

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Fetch the catalog and artifacts over the network. #3719 @ 593f8b3

CI run: https://github.com/apache/nuttx-apps/actions/runs/31878516149

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Fetch the catalog and artifacts over the network. #3719 @ 7305777

CI run: https://github.com/apache/nuttx-apps/actions/runs/31879827062

[github-actions]

🔗 Cross-repo PR dependencies

The read-only Build run reported the following dependent PR(s) and fetched head SHA(s):

• system/nxpkg: Fetch the catalog and artifacts over the network. #3719 @ bd89092

CI run: https://github.com/apache/nuttx-apps/actions/runs/31955914104