Check

Fetch the latest GitHub Release synchronously (up to a 10s timeout) and persist it.

Read-only with respect to job: a check never starts, clears, or otherwise touches the update job, so a done/failed job from an earlier apply/rollback stays visible (with its own retry_available) across any number of checks.

Raises: PortalError: 409 update_in_progress while a job is already running/restarting/checking; 429 update_check_rate_limited (with retry_after_seconds) if the last check was under a minute ago; 404 no_release / 502 release_source_unavailable -- mapped 1:1 from :class:~palmimo_portal.ports.ReleaseSourceError's code; 502 release_source_unavailable again if the release source's tag_name is not :func:~palmimo_portal.core.update.is_valid_release_tag -- a malformed tag is exactly as unusable to this Portal as GitHub itself being unreachable.