force-update: single-shot with a 30s fail-fast timeout

SPEC.md

@@ -263,11 +263,13 @@ executable location as-is and leaves the config untouched.
   idle the process exits with code 3 so the service recovery restarts it
   on the new version. Interactive runs only log "restart to apply".
   `dev` builds and builds without an embedded public key never update.
-- **`--force-update`** runs the same check immediately: it downloads,
-  verifies and stages a newer release, and if the service is running it
-  restarts it right away (otherwise the new version applies on next
-  start). On Windows it elevates via UAC only when the stage or restart
-  needs permissions the caller does not have.
+- **`--force-update`** runs the same check immediately, single-shot: one
+  attempt with a 30 s timeout, then exit — "up to date" (exit 0) or the
+  error (exit 1), no retries. When a newer release is found it downloads,
+  verifies and stages it, and if the service is running it restarts it
+  right away (otherwise the new version applies on next start). On Windows
+  it elevates via UAC only when the stage or restart needs permissions the
+  caller does not have.
 - **Signing setup (one time)**: `openssl genpkey -algorithm ed25519 -out
   private.pem`; `openssl pkey -in private.pem -pubout -out public.pem`.
   Private key → repo secret `RELEASE_SIGNING_KEY`; public key → committed into