v1.7.0 — auto-update: check and stage, install stays with the platform

Adds github_update: check reports whether a newer release exists, stage downloads it and verifies its sha256 against the digest GitHub publishes.

What it does — and deliberately does not do

check   → is there a newer release?              read-only
stage   → download it and verify its digest      writes one file
install → plugin_manager install_bundle          platform, approval-gated
restart → you                                    platform

Three measured constraints put installation and the restart outside this plugin:

• Node's fetch cannot reach github.com on a TLS-intercepted host (UNABLE_TO_VERIFY_LEAF_SIGNATURE while gh succeeds), so every network call goes through gh — the same reason github_api routes through gh api.
• A replaced bundle needs a restart. Node has already imported the old module generation; writing new files changes nothing until the Host restarts.
• Installation is owned by the plugin manager. install_bundle rewrites the profile's package.json, prunes node_modules, and applies the patch row. A plugin editing the profile itself would desynchronise those and bypass the approval step that gates running downloaded code.

So stage returns a path and states installed: false, next.restartRequired: true.

Details

• The digest is checked, and "no digest" is not "verified". Three outcomes — match, mismatch, unverified. A mismatch refuses to stage and prints both hashes. An intact staged copy is reused unless force: true.
• unknown is its own answer. An unparseable version pair is never reported as "up to date", and a source checkout that is ahead of every release is told so instead of being offered a downgrade.
• updateCheck: true (default false) adds a cached 24-hour startup notice. Off by default: an activation-time network call is a surprise.

Verification

Suite	Result
Offline tests	157/157 (17 new)
Parameter coverage	211/211 across 9 tools
Behaviour snapshots	180/180 deterministic
argv shapes parsed by real gh	84/84
Live end-to-end against the real release	11/11 — read, download, digest match, reuse, tamper detection

The live probe (npm run probe:update) downloads the real 203 KB asset, verifies its digest against GitHub's published sha256:1b2c234e…, and catches a one-byte tamper as mismatch.

New config keys: updateCheck, updateRepo, updateChannel, updateCacheDir.

Full detail in CHANGELOG.md.