fix: count deferred APT updates

[RomeoRaven]

Summary

• count deferred/kept-back APT candidates reported as N not upgraded
• include deferred candidates in updates_total so pending updates cannot report status=ok
• expose only the privacy-safe aggregate updates_deferred; package names remain omitted
• update documentation, checksum, and behavioral regression coverage

Safety boundary

• APT remains simulation-only via apt-get -s upgrade
• no metadata refresh, install, remediation, reboot, service, cron, tag, or release action
• DNF remains cache-only and reports updates_deferred=0

Verification

• RED: exact kept-back fixture produced 3 targeted failures before implementation
• GREEN: focused Linux suite 153/153
• full suite 183/183
• launcher suite 102/102
• doctor, strict checksums, Bash parsing, pinned ShellCheck, and diff hygiene passed
• parser-removal and total-removal mutations were killed
• independent exact-tree review: merge-ready, no findings; 6/6 adversarial APT variants passed

Release hold

Do not release v2.1.0 before this corrective PR merges.

Follow-up to #20.

[RomeoRaven]

Code Review Summary

Verdict: Merge-ready

Findings

• Blocking: none
• Warnings: none
• Suggestions: none

Reviewed

• exact head f40844beae09c99983eeff8dc624891b1d2577f9 against master
• all four changed files and full update-posture.sh context
• APT simulation-only and DNF cache-only boundaries
• deferred-count parsing, total/status semantics, package-name privacy, documentation, checksum, and regression sensitivity

Proof

• full suite: 183/183
• focused Linux suite: 153/153
• launcher suite: 102/102
• six adversarial APT summary variants: 6/6
• parser-removal and total-removal mutations killed
• doctor, strict checksums, Bash parsing, pinned ShellCheck, and diff hygiene passed
• both GitHub Actions checks passed
• independent exact-tree review passed with no findings

No merge, tag, or release was performed. GitHub does not permit an author to approve their own PR, so this review is submitted as a non-blocking comment.