fix(cli): caret-bound mops update and mops outdated by default

[Kamirus]

Problem

mops update and mops outdated jumped across major versions by default. Pinning core = "2.0.0" and running mops update would happily move you to a future 3.0.0 — silently breaking the project. This is the opposite of what cargo update and npm update do, and the opposite of what users expect from "update".

Fix

Both commands are now caret-bound by default:

• 0.x.y → bumps within 0.x.y (patch only — pre-1.0 minors are treated as breaking, matching cargo/npm)
• 1.x.y and above → bumps within <major>.x.y (minor + patch)

Old behavior is one flag away: --major opts back into cross-major updates (same flag for both commands for consistency).

Hard-pinned (pkg@x.y.z) and prefix-pinned (pkg@x / pkg@x.y) deps are unchanged — pinning already encodes the bound the user wants.

Why "fix" and not "breaking"

The previous default was a footgun, not a contract. Anyone who actually wanted cross-major bumps was either burned by it or never noticed. The escape hatch (--major) is one flag away.

Test plan

• mops update (default) bumps base 0.14.5 within 0.14.x and leaves core 1.0.0 alone (no 1.x.y > 1.0.0 exists)
• mops update --major bumps both past their major bounds
• mops outdated mirrors the same behavior with --major parity
• Lint + typecheck clean
• --help for both commands shows --major

Docs

• docs/docs/cli/1-deps/04-mops-update.md — documents --major and the new default
• docs/docs/cli/1-deps/03-mops-outdated.md — same
• cli/CHANGELOG.md — single-line fix entry under ## Next
• .agents/skills/mops-cli/SKILL.md — updated cheat-sheet
• AGENTS.md — added a note that base is deprecated; new examples should use core (caught while writing this PR's docs)

Made with Cursor