Administrative lifecycle for trusted OTP applications on SD.

Code lives under /mnt/apps/apps/<app>/<version> and application data under /mnt/apps/data/<app>. Only enabled/active/previous selection is persisted in /data/nerves_gate/apps.term. Install does not start an application. Upgrades are cold stop/start with a health check and rollback; this is not a sandbox or an OTP hot-code upgrade service. Uninstall preserves application data.