Fold PromoteSource into Update

Every PromoteSource caller already loaded the tracker pattern under
the same transaction, so a dedicated single-column UPDATE only
duplicated machinery and forced callers to learn a second mutation
verb. Add `source = @source` to Update's SET clause, mutate
Source/UpdatedAt on the receiver, and call Update at the three
promotion sites (worker merge loop, worker adoption loop, and
reportDetectedTracker). The shouldPromoteSource gate still ranks the
candidate against the loaded value; Update is now the single write
path that can advance source, with a doc comment spelling out the
load-first contract.

Re-cast the coredata tests around Update: WritesSource pins the
round-trip from receiver to DB, NotFoundForMissingRow preserves the
ErrResourceNotFound contract callers rely on. The old
OnlyTouchesSourceAndUpdatedAt test was a property of the narrow
PromoteSource UPDATE and no longer applies — Update intentionally
rewrites the full editable column set from the receiver.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/pattern_analysis_worker_process_test.go

@@ -521,7 +521,8 @@ func TestPatternAnalysisWorker_AdoptionPromotesSourceCrossCategory(t *testing.T)
 // detected_tracker straight to the glob, so no new exact is
 // created and the merge/adoption loops in
 // patternAnalysisHandler.Process never see the new signal. Without
-// the in-line PromoteSource call in reportDetectedTracker, only
+// the in-line source promotion in reportDetectedTracker (which
+// mutates matchedPattern.Source and writes via Update), only
 // last_matched_at would advance — source would stay stuck at
 // PRE_EXISTING despite the new SDK-observed evidence. This test
 // pins the same-category promotion path; the cross-category gap