fix: harden mirrored downloads and first-run upgrades

scripts/bootstrap_python.ps1

@@ -8,7 +8,7 @@ function Get-BootstrapText {
 }
 
 function Initialize-ArtemisPython {
-    param([Parameter(Mandatory=$true)][string]$ProjectRoot)
+    param([Parameter(Mandatory=$true)][string]$ProjectRoot, [switch]$RuntimeOnly)
 
     $ProjectRoot = (Resolve-Path -LiteralPath $ProjectRoot -ErrorAction Stop).Path
     if (-not (Test-Path -LiteralPath (Join-Path $ProjectRoot 'pyproject.toml'))) {
@@ -65,6 +65,10 @@ function Initialize-ArtemisPython {
             throw (Get-BootstrapText 'The existing .venv is unusable or older than Python 3.12. Rename it as a backup, then rerun start.bat.' '已有 .venv 无法使用或 Python 低于 3.12。先重命名备份，再运行 start-cn.bat。')
         }
 
+        # The frozen source updater uses only Python's standard library. Install
+        # project dependencies once, from the new lock file AFTER the fast-forward.
+        if ($RuntimeOnly) { return $pythonExe }
+
         # A cheap check skips installation when the lock and installed packages agree.
         # --inexact preserves any optional development tools already installed.
         $lockOption = if ($ArtemisDownloads -and $ArtemisDownloads.python_index) { '--frozen' } else { '--locked' }