fix(cli): update no longer copies package internals into adopter projects (cli-3.5.3)

[montfort]

Summary

• Fixes a bug where devtrail update / devtrail update-framework deposited the framework's internal dist-manifest.yml and dist-templates/ directory into the root of the adopter project. Detected after running devtrail update in a downstream repo and noticing two unexpected artifacts at the project root.
• Root cause: update_files() in cli/src/commands/update_framework.rs walked every file extracted from the release ZIP and copied any path not already present in the target. The two ad-hoc skips (.devtrail/.checksums.json, .devtrail/dist-manifest.yml) didn't catch the package-root dist-manifest.yml or anything under dist-templates/. devtrail init was already correct — it iterates the patterns declared in manifest.files — so the two paths had drifted apart.
• Update path now applies the same whitelist via a small matches_manifest() helper (directory patterns end in /, file patterns are exact), mirroring init.rs::extract_matching_files. Path comparison normalizes \ → / so the whitelist works on Windows too.
• Bumps CLI to 3.5.3, updates CHANGELOG.md and the EN/ES/zh-CN versioning tables in README.md and CLI-REFERENCE.md.

Cleanup for already-affected projects

rm dist-manifest.yml
rm -rf dist-templates
devtrail update-framework   # regenerates .devtrail/.checksums.json without orphan entries

Test plan

• cargo check clean.
• cargo test — all 231 tests pass, including three new unit tests in update_framework::tests that lock in the regression: package_artifacts_are_rejected (asserts dist-manifest.yml and dist-templates/directives/CLAUDE.md are filtered out), declared_files_and_directories_match, and undeclared_paths_are_rejected.
• After merge: tag cli-3.5.3 to trigger release-cli.yml and verify all 4 platform binaries are published.
• Smoke test post-release: in a project previously affected by the bug, run devtrail update-cli then devtrail update-framework and confirm dist-manifest.yml / dist-templates/ no longer appear at the project root.

🤖 Generated with Claude Code