New system package checks `apt list --upgradable` against the current
package index (no apt update triggered) and the reboot-required marker
file. Read-only - never installs or upgrades anything. Shown as a card
on the About page with a manual "Check now" refresh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
