feat(install): add --update to re-run active-layer installers and improve Nix refresh logic

* Add `force_update` to `RepoContext` and propagate it through install/update flows
* Add `pkgmgr install --update` to force re-running installers even if the same CLI layer is already loaded
* Enhance `NixFlakeInstaller` to ensure correct outputs (pkgmgr + optional default for package-manager) and support refresh/upgrade with index-based fallback remove+reinstall
* Make Python/Makefile installers emit an “upgraded” marker when `force_update` is used
* Add E2E tests for “three times install” scenarios (makefile, nix, venv) with shared run helper
* Fix git safe.directory wildcard quoting in E2E shell runner and minor cleanup/reordering of imports/comments

https://chatgpt.com/share/693db0b4-6ea4-800f-b44a-f03939c7fb9e

tests/e2e/test_install_pkgmgr_three_times_nix.py

@@ -0,0 +1,37 @@
+import os
+from tests.e2e._util import run
+import tempfile
+import unittest
+from pathlib import Path
+
+
+class TestPkgmgrInstallThreeTimesNix(unittest.TestCase):
+    def test_three_times_install_nix(self):
+        with tempfile.TemporaryDirectory(prefix="pkgmgr-nix-") as tmp:
+            tmp_path = Path(tmp)
+
+            env = os.environ.copy()
+            env["HOME"] = tmp
+
+            # Ensure nix is found
+            env["PATH"] = "/nix/var/nix/profiles/default/bin:" + os.environ.get("PATH", "")
+
+            # IMPORTANT:
+            # nix run uses git+file:///src internally -> Git will reject /src if it's not a safe.directory.
+            # Our test sets HOME to a temp dir, so we must provide a temp global gitconfig.
+            gitconfig = tmp_path / ".gitconfig"
+            gitconfig.write_text(
+                "[safe]\n"
+                "\tdirectory = /src\n"
+                "\tdirectory = /src/.git\n"
+                "\tdirectory = *\n"
+            )
+            env["GIT_CONFIG_GLOBAL"] = str(gitconfig)
+
+            for i in range(1, 4):
+                print(f"\n=== RUN {i}/3 ===")
+                run(
+                    "nix run .#pkgmgr -- install pkgmgr --update --clone-mode shallow --no-verification",
+                    env=env,
+                    shell=True,
+                )