POST /updates/apply short-circuits (returning a payload without the per-branch
keys like is_windows_installer) when the module-global _update_status is
downloading/installing. A prior test leaving an apply flow mid-update made
test_apply_update_windows_installer_rejection hit that guard instead of the
Windows branch — an order-dependent flake that passed locally but failed on the
sharded CI run with KeyError: 'is_windows_installer'. Add an autouse fixture
resetting _update_status to idle before each TestUpdatesAPI test.