gstack-update-check caches UP_TO_DATE when the remote version could not be read

\`bin/gstack-update-check\` fetches the remote VERSION (via \`git ls-remote\` SHA, then the branch-pinned URL fallback) and validates it against \`^[0-9]+\.[0-9.]+$\`. When validation fails it writes \`UP_TO_DATE $LOCAL\` to the cache (line 256) and exits 0.

Input that passes while broken: both fetch paths fail (no network, no git, blocked raw.githubusercontent.com), or the endpoint returns an HTML error page. \`REMOTE\` is empty or HTML, the regex rejects it, and a fresh \`UP_TO_DATE\` line is cached for the 60-minute TTL. Every later run inside the TTL is silent, and an actual upgrade is never surfaced. \`browse/test/gstack-update-check.test.ts\` (Path G around line 212, Path H around line 223) asserts this as the expected outcome.

Fix: cache \`CHECK_FAILED\` (or \`UNKNOWN\`) with a short TTL on the invalid-response branch, and reserve \`UP_TO_DATE\` for a parsed remote version equal to (or lower than) local.

Same class as #1974 (closed).

Start in bin/gstack-update-check around line 256, then read Path G and Path H in browse/test/gstack-update-check.test.ts around lines 212 and 223. Exercise the failed fetch and invalid-response cases, and update the behavior and tests so only a parsed remote version can produce UP_TO_DATE while failures use a short-lived failure state.

Written by the indexing model from the issue text.