Fix selected Preboot identity patch application during guest environment updates

Overview

Fix selected Preboot identity patches remaining unapplied after a guest environment update.

The patch was classified as applicable through update-environment, but the installer restricted its application to full CFW installs. Consequently, Launchpad’s Apply to Guest could complete while the selected identity patch remained pending.

Changes (Detail)

• Apply the Preboot identity rewrite during environment updates when enabled in the resolved patch plan.
• Reuse the installed device tree without requiring a prepared restore tree or a full reinstall.
• Cover every entry point using the shared environment-update flow, including Launchpad, CLI updates, bundle changes, and template guest-patch application.
• Preserve existing patch selection, device applicability checks, repair ordering, and backup behavior.
• Update the patch comparison documentation.

Other guest patches already use the shared application pipeline; their application behavior remains unchanged.

Validation

• Manual testing and review completed.
• Verified that applying the selected patch to an existing guest updates its reported identity after reboot.
• All 77 existing tests across eight relevant suites passed.
• Full VPhone Debug build and bundle admission checks passed.