Function renderTemplateUpgrade

Re-render a catalog-deployed application against a NEW template version: merge the stored parameter map with the caller's overrides (edits to carried parameters AND answers for newly declared ones), then render exactly as a fresh deploy would — so the result carries the renderer's own templateRef + templateParameters stamp for the new version. Pure and browser-safe.

Merge order is storedParams then overrides; an override wins. Parameters the target no longer declares are a LOUD refusal (TemplateParamsRemovedError) rather than a silent drop. An override naming a parameter that does not exist in the target is rejected by the renderer as TemplateParameterError ("is not a declared parameter").

This helper does NOT gate the upgrade — call checkUpgradeEligibility first — and it mints nothing: generated secrets for newly declared parameters are the caller's job (see TemplateUpgradeParamDiff.addedGeneratedSecrets), passed in through overrides as {secret, key?} refs.