feat(install): add --update to re-run active-layer installers and improve Nix refresh logic

* Add `force_update` to `RepoContext` and propagate it through install/update flows
* Add `pkgmgr install --update` to force re-running installers even if the same CLI layer is already loaded
* Enhance `NixFlakeInstaller` to ensure correct outputs (pkgmgr + optional default for package-manager) and support refresh/upgrade with index-based fallback remove+reinstall
* Make Python/Makefile installers emit an “upgraded” marker when `force_update` is used
* Add E2E tests for “three times install” scenarios (makefile, nix, venv) with shared run helper
* Fix git safe.directory wildcard quoting in E2E shell runner and minor cleanup/reordering of imports/comments

https://chatgpt.com/share/693db0b4-6ea4-800f-b44a-f03939c7fb9e

tests/e2e/test_install_makefile_three_times.py

@@ -0,0 +1,25 @@
+from tests.e2e._util import run
+import tempfile
+import unittest
+from pathlib import Path
+
+class TestMakefileThreeTimes(unittest.TestCase):
+    def test_make_install_three_times(self):
+        with tempfile.TemporaryDirectory(prefix="makefile-3x-") as tmp:
+            repo = Path(tmp)
+
+            # Minimal Makefile with install target
+            (repo / "Makefile").write_text(
+                "install:\n\t@echo install >> install.log\n"
+            )
+
+            for i in range(1, 4):
+                print(f"\n=== RUN {i}/3 ===")
+                run(["make", "install"], cwd=repo)
+
+            log = (repo / "install.log").read_text().splitlines()
+            self.assertEqual(
+                len(log),
+                3,
+                "make install should have been executed exactly three times",
+            )