Fix pacman updater package discovery

[amandeepsp]

Summary

• require rebuilt package candidates to be regular files
• ignore pacman's codex-desktop-latest.pkg.tar.zst symlink during artifact discovery
• add a regression test covering the versioned archive plus latest-symlink layout

The pacman builder intentionally writes both a versioned package and a stable
latest symlink. The updater previously matched entries by filename alone, so
it counted both paths and left Arch updates in Failed with
expected one rebuilt package, found 2.

This keeps the existing exactly-one-artifact invariant while excluding aliases,
directories, and other non-regular entries from the candidate set.

Validation

• cargo test -p codex-update-manager (50 passed)
• cargo clippy -p codex-update-manager --all-targets -- -D warnings
• git diff --check
• end-to-end Arch update from the signed 26.810.52044 package: rebuild,
  privileged pacman install, state transition to Installed, and subsequent
  check settling to Idle

cargo fmt --all -- --check was also inspected, but current unmodified main
already reports repository-wide formatting differences across updater files;
this PR does not broaden the diff to reformat them.

Checklist

• This pull request is ready for review and is no longer a draft.
• I followed CONTRIBUTING.md, kept the change focused, edited source files rather than generated output, and removed unrelated changes.
• Upstream drift checklist is not applicable; this fixes local pacman updater artifact discovery.
• I added relevant regression coverage and ran the validation listed above.
• I reviewed the final diff with my coding agent using maximum reasoning effort, addressed all findings, and reran the relevant tests.

[ilysenko]

Thanks for the update. When this is ready for maintainer review, please remember to mark the pull request as ready for review instead of leaving it in draft.