hotfix(ota): provision LiteRT runtime on update

[slomin]

Summary

• add best-effort LiteRT provisioning to the OTA apply path for devices upgraded from earlier images
• install litert-lm-api into the Potato venv when possible and create /opt/potato/runtimes/litert/runtime.json from the installed package version
• attempt libvulkan1 installation non-fatally because OTA may not have passwordless apt privileges

Closes #318

Test evidence

• uv run python -m pytest tests/unit/test_update_state.py -q: 98 passed
• uv run python -m pytest tests/unit tests/api -q -n auto: 585 passed
• npx playwright test --reporter=dot --timeout=15000 --workers=75%: 118 passed

QA / risk notes

• This is intentionally best-effort: missing apt privileges or unavailable LiteRT wheels are logged and do not roll back the OTA.
• Existing llama runtime slots are not modified.
• Real Pi OTA validation should verify that a 0.7.1-upgraded device receives the litert runtime slot after applying the hotfix.