#21398 acpmux: require version evidence for already-current updates

A named agent update could report success without running an updater when the latest version was missing or unparseable. Require comparable installed and latest versions before reporting an already-current result. Unknown evidence now returns the existing refusal; equal or newer installed versions remain successful no-ops.

Validation: formatting, clippy, compilation and all six selected tests pass on the reviewed fleet. Three incorrect-success regressions fail before the fix; equal-version and newer-installed controls pass.

Stacked on #21385.

Changelog

Fixed: Named agent updates refuse unknown latest-version evidence instead of reporting the CLI current.