fix: defer --update cleanup until after preflight checks pass

[hcastc00]

Summary

• Fix --update data-loss bug: a failing preflight check (e.g. VPN port conflict) used to wipe on-disk artifacts before the script had decided whether the install would proceed.
• Destructive cleanup (docker-compose-*.yml, dappnode_package-*.json, *.txz, *.tar.xz, packages-content-hash.csv) is now deferred to a new clean_for_update function called after resolve_packages.
• bootstrap_filesystem still removes the logfile and .dappnode_profile early, so ensure_profile_loaded re-downloads the latest profile (preserving existing behavior).
• check_vpn_ports_conflict now recognizes ports held by our own VPN/Wireguard core containers (mirroring the existing check_https_ports_conflict pattern), so an --update on a running node no longer aborts on its own ports.

Why

In main(), bootstrap_filesystem ran the UPDATE=true cleanup block before resolve_packages invoked check_vpn_ports_conflict. If the port check failed and exited the script, /usr/src/dappnode/DNCORE/ ended up with no compose files on disk. The currently running containers stayed up (they hold the ports), so the node kept working until the next restart — at which point nothing came back, because the YAML was gone.

Repro (before this PR)

On any existing dappnode where the OpenVPN container is bound to 1194/UDP + 8092/TCP:

sudo wget -O - https://installer.dappnode.io | sudo bash -s -- --update

The script aborts on the port conflict and /usr/src/dappnode/DNCORE/ is left empty of composes/manifests/archives.

After this PR

--update on a running node now proceeds normally: the self-aware port check recognizes our own VPN/Wireguard containers as non-conflicts and lets the install replace them. Even if a real port conflict is detected (foreign process), the destructive cleanup is skipped, so the previous artifacts remain on disk and the node is unaffected.

Test plan

• Fresh install on Linux (no --update): unchanged behavior.
• --update on a node with the OpenVPN container holding 1194/UDP + 8092/TCP: script logs that the existing VPN container will be replaced and proceeds with the update.
• --update on a node with the Wireguard container holding 51820/UDP: script logs that the existing Wireguard container will be replaced and proceeds with the update.
• --update with a real foreign-process conflict on 1194/UDP, 8092/TCP, or 51820/UDP: script aborts with the port conflict error AND /usr/src/dappnode/DNCORE/ still contains the previous docker-compose-*.yml, dappnode_package-*.json, and *.txz files.
• macOS install path unaffected.