fix(preset,binary): argsh update stuck at old version

[fentas]

Summary

`b u argsh` stayed on the currently-installed version forever even when upstream had a newer release. Two compounding bugs:

1. `pkg/binaries/argsh/argsh.go` — `VersionLocalF` ran `argsh version`, but argsh accepts `--version` (no subcommand). The exec returned a non-zero exit so `VersionLocalF` returned `("", err)`. Even if the subcommand had worked, the parser split the output on whitespace and took the last token, which for real output `argsh v0.6.5 ()` was the commit sha, not the version.

Fix: call `--version`, use `strings.Fields`, and grab `fields[1]` → `v0.6.5`.

2. `pkg/binary/binary.go` — `EnsureBinary`'s skip check was:
```go
if local.Version == local.Enforced || local.Enforced == "" && local.Latest == local.Version {
return nil
}
```
When `VersionLocalF` errors, `LocalBinary` swallows the error and sets `version=""`. The check then matches `"" == ""` and returns nil. Net effect: any preset whose version probe breaks silently skips every update.

Fix: treat `local.Version == ""` as "unknown" and fall through to `DownloadBinary` instead of short-circuiting.

This is a latent-bug class — beyond argsh, any preset with a broken version probe (or a new CLI where the probed subcommand was removed) was failing silently. The fix is at the framework level so future presets can't hit the same wall.

Also in this PR

`managedKey` in `pkg/state/yamlmerge.go` was missing `enforced` at `binaries.` — `BinaryList.MarshalYAML` emits `enforced:` (added in #149) but `managedKey` (landed in #148, slightly earlier) didn't know about it. `TestManagedKey_MatchesMarshalOutput` was red on main. Fixed here because the fix is in the same small surface area.

Test plan

• `TestBinary_EnsureBinary_UpdateWhenLocalVersionUnknown` — guards against the silent-skip regression.
• Existing `TestBinary_argsh` still passes (binary generation unchanged).
• `go test ./...` — all 39 packages pass.
• End-to-end: `b u argsh` now moves from v0.6.5 → v0.6.6 (verified with a local build against `github.com/kernpilot/lok8s`).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes b update argsh (and similar presets) getting stuck by correcting argsh local version detection and preventing EnsureBinary from silently skipping updates when the local version is unknown.

Changes:

• Fix argsh local version probing to use --version and parse the actual semver token.
• Update EnsureBinary to avoid early-returning when local.Version is empty/unknown.
• Align YAML merge schema management with BinaryList.MarshalYAML by treating enforced as a managed key.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/state/yamlmerge.go	Adds enforced to the managed key set for binaries.<name> to match marshal output.
pkg/binary/binary_test.go	Adds regression test to ensure updates proceed when local version detection fails.
pkg/binary/binary.go	Prevents update skip when local.Version is empty/unknown.
pkg/binaries/argsh/argsh.go	Fixes argsh local version command and parsing to return vX.Y.Z correctly.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.