🐛 fix(seed): guard every embed update log read, not just one

[darrenhuai]

#3376 made UpdateLog.from_app_data drop an embed update log that holds JSON of the wrong shape. Three other readers in periodic_update.py still parse the file with the raw UpdateLog.from_dict(embed_update_log.read()), and one of them runs first on the default path, so the guard only helps runs with --no-periodic-update.

With periodic update on (the default), handle_auto_update hits the bad log before from_app_data ever sees it. The app-data seeder logs the TypeError as fail with a traceback, then retries with download=True and pulls pip from PyPI even though nobody asked for a download. Offline it fails outright:

$ echo '{"completed": null, "periodic": null, "started": null, "versions": {}}' > <app-data>/wheel/3.14/embed/3/pip.json
$ PIP_NO_INDEX=1 virtualenv venv
RuntimeError: seed failed due to failing to download wheels pip

#3376's own test passed do_periodic_update=False, which is why it never reached this.

add_wheel_to_update_log and the background _run_do_update have the same unguarded read. All three now go through from_app_data, so a malformed log gets dropped with one warning wherever it's first read, and the reset log schedules a fresh periodic update the way a never-run log does.

The malformed-log cases are shared across the four entry points as _MALFORMED_LOGS. Each new test fails when its own call site is put back to from_dict. The full suite, ruff, and ty (3.9 and 3.14) pass.

Something I noticed but left alone: test_periodic_update_skip and test_periodic_update_trigger pass os.environ, True positionally into (do_periodic_update, env), so the arguments are swapped. They only pass because os.environ is truthy. Happy to send that as a separate fix if you want it.

[gaborbernat]