Closes the two deferred BeginTx-vs-unary parity gaps recorded with the 0.4.27
side-effect-parity fixes.

- update is now a supported BeginTx operation: a mutation with
  operation="update" SETs the `changes` columns and/or applies atomic
  `increments` on the rows matched by `filter`, atomically with the rest of the
  transaction. Unary Update and the transactional update now share one
  execute_update_in_tx core (plan → bind → execute → projection enqueue → CDC
  emit) so the paths cannot diverge on side-effects. Saga/best-effort only;
  two_phase+update fails closed; CAS `expected` is not carried on the tx path
  (removed from the proto rather than advertised-and-ignored).
- TxStatus.write_receipt: a committed BeginTx now returns a WriteReceipt
  (source LSN + outbox seq + manifest checksum) so a client can fence a
  following read for read-your-writes, exactly as MutationResponse.write_receipt
  on the unary verbs (BeginTx previously returned no receipt).

Additive proto fields only (Mutation.changes/increments, TxStatus.write_receipt)
— no wire break. Regenerates all 6 SDK stubs + swagger; bumps versions.json
0.4.27 -> 0.4.28 (propagated); regenerates codebase-map.

Local: udb lib compiles clean with all features (0 errors); cargo fmt --check
clean; error-detail posture OK; codebase-map up to date; actionlint clean. Full
test suite + live conformance run in CI.