Nginx validation fix

Fix sandboxed Nginx validation for managed upgrades in 1.0.6

Version 1.0.6 fixes managed updates that passed the application build but failed while validating Nginx. The updater now has narrowly scoped access to the existing Nginx PID file and permission to validate HTTPS listeners. This also removes the same permission blocker from deployment rollback while preserving the existing filesystem protections and worker privilege restrictions.

New Linux regressions reproduce the read-only PID-file error and denied HTTPS bind, then verify that both Nginx validation commands succeed with the corrected permissions without changing the PID. Recovery documentation explains the one-time drop-in needed by older installed updaters before retrying through the upgrade button.