Apply consented grouped Claw updates (#102982)

* Apply consented grouped Claw updates

* test(claws): cover update application

* docs(claws): document consented updates

* fix(claws): preserve uncertain update state

* fix(claws): preserve inherited lifecycle guards

* fix(claws): derive update package contracts

* fix(claws): type update package lookup

* test(claws): complete update capability fixtures

* refactor(claws): share cron payload builder for updates

* refactor(claws): extract update plan summary

* fix(claws): activate cron after update dependencies

* fix(claws): preserve state after uncertain cron update

* fix(claws): persist partial update provenance

* fix(claws): preserve update ownership metadata

* test(claws): track update apply temp dirs

* test(claws): align update cron mock result

* fix(claws): update apply writes agent entries

---------

Co-authored-by: Patrick Erichsen <patrick.a.erichsen@gmail.com>

src/cli/claws-cli.ts

@@ -17,7 +17,13 @@ export type ClawsAddOptions = {
 };
 
 export type ClawsStatusOptions = { json?: boolean };
-export type ClawsUpdateOptions = { from?: string; dryRun?: boolean; json?: boolean };
+export type ClawsUpdateOptions = {
+  from?: string;
+  dryRun?: boolean;
+  yes?: boolean;
+  planIntegrity?: string;
+  json?: boolean;
+};
 export type ClawsRemoveOptions = {
   dryRun?: boolean;
   yes?: boolean;
@@ -80,6 +86,8 @@ export function registerClawsCli(program: Command) {
     .argument("<claw-or-agent>", "Installed package name or final agent id")
     .option("--from <source>", "Override the target source recorded at Claw add time")
     .option("--dry-run", "Preview update actions without mutating state", false)
+    .option("--yes", "Confirm the exact supported update plan", false)
+    .option("--plan-integrity <digest>", "Bind consent to an exact update plan")
     .option("--json", "Print JSON", false)
     .action(async (target: string, opts: ClawsUpdateOptions) => {
       const { runClawsUpdateCommand } = await import("./claws-cli.runtime.js");