audit.py --update-baseline <tool> replaces the whole baseline instead of merging

[CybotTM]

Running the baseline update for a single tool drops every other entry from upstream_versions.json:

uv run python audit.py --update-baseline vault
# upstream_versions.json: 549 lines removed, only the vault entry remains
git diff --stat upstream_versions.json
#  upstream_versions.json | 549 +------------------  7 insertions(+), 542 deletions(-)

Observed 2026-07-23 while adding vault to the catalog (PR #124). Expected: a tool-scoped --update-baseline merges the collected entry into the existing versions map (like the surviving entries' semantics suggest), leaving all other tools untouched. Actual: the file is rewritten with only the requested tool.

Workaround used in #124: restore the file from git, then merge the entry manually with the same json.dump(..., indent=2, ensure_ascii=False, sort_keys=True) format.

If accidental single-tool invocation is instead considered unsupported, it should error out rather than silently destroy the committed baseline.