azd update: crash-loop guard for auto-update

## Problem
No sentinel file or `AZD_SKIP_AUTO_UPDATE` escape hatch. The applied marker file is display-only. If the new binary panics during startup before completing initialization, users have no env var to bypass auto-update.

## Proposed
- Add `AZD_SKIP_AUTO_UPDATE` env var that bypasses `ApplyStagedUpdate` entirely
- Track consecutive apply failures; disable auto-apply after N failures
- Optionally: write a "last good version" marker for manual recovery

## Context
Raised in design review #6910 and PR #6942 code review.

Parent epic: #6721