docs(openspec): archive fpagent-install-upgrade and sync specs

Documents release pinning (--tag), the pinned-tag metadata route,
installed-version tracking with upgrade reporting, and restart of a
managed running service on upgrade; syncs the four requirements into the
fpagent-installer main spec.

openspec/changes/archive/2026-10-02-fpagent-install-upgrade/tasks.md

@@ -0,0 +1,19 @@
+# Tasks
+
+- [x] 1. App: add `/fpagent/releases/tags/:tag`, sharing the release-metadata
+  handler with `/fpagent/releases/latest`; reject invalid tags without contacting
+  the forge.
+- [x] 2. Hosted installer: parse `--tag`, fetch the pinned tag's metadata,
+  derive the git hash from the asset name, and write it as `VERSION` into the
+  extracted bundle before handoff.
+- [x] 3. Bundle installer (`fingerprint-agent`): read `VERSION` beside the script
+  or the binary, report `upgrading <old> -> <new>` from `${INSTALL_PATH}.version`,
+  stamp the new version, remove it on uninstall.
+- [x] 4. Bundle installer: restart an already-running `fpagent.service` after
+  `enable --now` (via `is-active`, so a fresh install does not restart).
+- [x] 5. `bundle.sh`: ship `VERSION` in the bundle.
+- [x] 6. Tests: tag-route metadata and invalid-tag rejection; `--tag` makes the
+  installer request the tag endpoint, not latest. Verified 59 tests pass.
+- [x] 7. Verified end to end: a real patched bundle served through a fake gateway
+  → hosted installer → bundle installer reported `upgrading fpagent deadbeef ->
+  cafebabe`, version `cafebabe`, with options forwarded.