feat(installer): restart only the service units whose version changed

[Developer-Simon]

Squash-merge commit message

feat(installer): restart only the service units whose version changed

A redeploy used to restart every service unit unconditionally. Now it
restarts only the ones whose own version changed, or whose imported
shared library changed (energy_node_common -> every service,
battery_soc_core -> battery_soc alone). Unknown always means restart
(no installed manifest, a missing version, an older manifest without
per-service versions), and a stopped unit is always started regardless
of the rule. The operator can still tick "Restart all services" to get
the old behaviour back, in both the installer and the dashboard's
redeploy page, which share the same web UI.

One rule decides this (scripts/bootstrap/lib/restart_rule.py); the
service steps and plan.sh call it, and the dashboard's Go
updaterhost.Plan carries a copy that both languages test against a
shared JSON table of cases (scripts/bootstrap/testdata/restart_cases.json).
"Restart all" travels as `restart_all` through the installer's
RunRequest and the dashboard's job.json, becoming EN_RESTART=all for
the steps.

Three incidental fixes found while building and testing this on a Pi:

- build_local_wheels() silently killed make_bundle.sh with no error
  message on a checkout that had never built a wheel locally before
  (libs/<lib>/dist/ didn't exist yet; find on a missing directory fails,
  and under set -e/pipefail that propagated into the cached=$(...)
  assignment with the real error thrown away by 2>/dev/null).
- Two lines in the package-preparation log (repo-build announcement,
  device upload/verify) were raw German literals on the plain log
  channel instead of a translation key, so they showed up untranslated
  during an English-language run.
- The "prepare" step ran under the "connect" station in the installer's
  step chain instead of getting its own entry.

Closes #

Summary

Checklist

• Subject line follows Conventional Commits
  (type(scope): summary) and matches the style in git log.
• Relevant checks from
  CONTRIBUTING.md → Running the checks
  pass locally (Python bridges, HA integration, Go dashboard, dashboard JS,
  dashboard smoke test — whichever the change touches).
• ./scripts/deploy/check_tracked_secrets.sh is clean — no real
  credentials, private-range IPs, or device serials.
• AI assistance, if any, is disclosed per
  AI-DISCLAIMER.md.
• For anything beyond a small fix: a linked issue describing the change.