Make site update recovery resilient and recoverable

Failed site updates could end `Fatal` with no path back; recovery now handles timeouts, re-runs idempotently, and provides usable error messages on disk space issues.