fix: apply_update concurrency lock, boot.js settings-fail guard, dead workspace code, test_updates URL param

- api/updates.py: add _apply_lock to prevent concurrent stash/pull/pop
- static/boot.js: set check_for_updates:false on settings fetch failure
- static/panels.js: remove dead settingsWorkspace references (element removed from HTML)
- api/routes.py + static/boot.js: add ?test_updates=1 URL param for testing banner
  without being behind on git (localhost-only simulate endpoint)

api/routes.py

@@ -231,7 +231,15 @@ def handle_get(handler, parsed) -> bool:
         settings = load_settings()
         if not settings.get('check_for_updates', True):
             return j(handler, {'disabled': True})
-        force = parse_qs(parsed.query).get('force', ['0'])[0] == '1'
+        qs = parse_qs(parsed.query)
+        force = qs.get('force', ['0'])[0] == '1'
+        # ?simulate=1 returns fake behind counts for UI testing (localhost only)
+        if qs.get('simulate', ['0'])[0] == '1' and handler.client_address[0] == '127.0.0.1':
+            return j(handler, {
+                'webui': {'name': 'webui', 'behind': 3, 'current_sha': 'abc1234', 'latest_sha': 'def5678', 'branch': 'master'},
+                'agent': {'name': 'agent', 'behind': 1, 'current_sha': 'aaa0001', 'latest_sha': 'bbb0002', 'branch': 'master'},
+                'checked_at': 0,
+            })
         from api.updates import check_for_updates
         return j(handler, check_for_updates(force=force))
 

api/updates.py

@@ -24,6 +24,7 @@ except ImportError:
 _update_cache = {'webui': None, 'agent': None, 'checked_at': 0}
 _cache_lock = threading.Lock()
 _check_in_progress = False
+_apply_lock = threading.Lock()   # prevents concurrent stash/pull/pop on same repo
 CACHE_TTL = 1800  # 30 minutes
 
 
@@ -108,6 +109,16 @@ def check_for_updates(force=False):
 
 def apply_update(target):
     """Stash, pull --ff-only, pop for the given target repo."""
+    if not _apply_lock.acquire(blocking=False):
+        return {'ok': False, 'message': 'Update already in progress'}
+    try:
+        return _apply_update_inner(target)
+    finally:
+        _apply_lock.release()
+
+
+def _apply_update_inner(target):
+    """Inner implementation of apply_update, called under _apply_lock."""
     if target == 'webui':
         path = REPO_ROOT
     elif target == 'agent':