fix: harden mirrored downloads and first-run upgrades

scripts/upgrade.ps1

@@ -11,6 +11,7 @@ $env:PYTHONUTF8 = '1'
 $env:PYTHONIOENCODING = 'utf-8'
 if ($Help) {
     Write-Host '用法：update.bat 或 update-cn.bat [-Help]'
+    Write-Host '未运行过启动脚本也可升级；缺少的 Python 环境会自动准备。'
     Write-Host '升级会终止本项目的 ARTEMIS 服务、MCP 和任务进程；保留配置、密钥与历史资料。'
     Write-Host '随后快进更新源码，同步依赖、网页构建和 Codex MCP；完成后请重新启动并重载 MCP。'
     exit 0
@@ -33,7 +34,7 @@ if (-not $Staged) {
         if ($fullStage.StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) { throw 'TEMP must be outside the project directory.' }
         New-Item -ItemType Directory -Path $stage | Out-Null
         $stageCreated = $true
-        foreach ($name in @('upgrade.ps1', 'installation_lock.ps1', 'upgrade_processes.ps1', 'update_installation.py')) {
+        foreach ($name in @('upgrade.ps1', 'installation_lock.ps1', 'upgrade_processes.ps1', 'update_installation.py', 'windows_tools.ps1', 'download_config.ps1', 'bootstrap_python.ps1')) {
             Copy-Item -LiteralPath (Join-Path $PSScriptRoot $name) -Destination (Join-Path $stage $name)
         }
         $forward = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', (Join-Path $stage 'upgrade.ps1'), '-Staged', '-ProjectRoot', $ProjectRoot)
@@ -47,13 +48,15 @@ if (-not $Staged) {
         if ($stageCreated -and (Test-Path -LiteralPath $stage)) { Remove-Item -LiteralPath $stage -Recurse -Force }
         Exit-ArtemisInstallationLock -Mutex $lock
     }
+    if ($code -ne 0 -and $env:ARTEMIS_NO_PAUSE -ne '1' -and -not [Console]::IsInputRedirected) {
+        try { Read-Host '[升级失败] 请查看上方原因。按回车键关闭窗口' | Out-Null } catch {}
+    }
     exit $code
 }
 
 try {
     Set-Location -LiteralPath $PSScriptRoot
     $python = Join-Path $ProjectRoot '.venv\Scripts\python.exe'
-    if (-not (Test-Path -LiteralPath $python)) { throw '尚未安装项目 Python 环境；请先运行 start.bat 或 start-cn.bat。' }
     if (-not (Get-Command git -ErrorAction SilentlyContinue)) { throw '未安装 Git，无法升级。' }
     if (-not (Test-Path -LiteralPath (Join-Path $ProjectRoot '.git'))) { throw '此目录不含 Git 信息；请改用 Git 克隆或新版发布源码包。' }
     # Refuse dirty checkouts before terminating the user's running processes.
@@ -64,6 +67,15 @@ try {
     Write-Host 'ARTEMIS 独立升级：将终止当前项目的服务、MCP 及任务。' -ForegroundColor Yellow
     . (Join-Path $PSScriptRoot 'upgrade_processes.ps1')
     Stop-ArtemisUpgradeProcesses -ProjectRoot $ProjectRoot
+    if (-not (Test-Path -LiteralPath $python)) {
+        Write-Host '[首次准备] 未找到项目 Python 环境，正在自动安装；随后拉取源码并同步新版依赖。' -ForegroundColor Cyan
+        . (Join-Path $PSScriptRoot 'windows_tools.ps1')
+        . (Join-Path $PSScriptRoot 'download_config.ps1')
+        . (Join-Path $PSScriptRoot 'bootstrap_python.ps1')
+        Initialize-ArtemisDownloads -ProjectRoot $ProjectRoot -Mode $Mirror
+        Update-EnvironmentPath
+        $python = Initialize-ArtemisPython -ProjectRoot $ProjectRoot -RuntimeOnly
+    }
     & $python (Join-Path $PSScriptRoot 'update_installation.py') source --root $ProjectRoot
     if ($LASTEXITCODE -notin @(0, 10)) { throw '源码升级未完成；配置和历史资料已保留。' }
     Stop-ArtemisUpgradeProcesses -ProjectRoot $ProjectRoot