Description

Adds a read-only upgrade-detection entry anolisa update --check for the
RPM / system-image scenario (issue #1410). It reports whether the RPM-owned
CLI and installed RPM components have newer repo candidates, and — with
--target <profile> — which profile default components are missing. It never
applies changes: only read-only rpm -q / dnf repoquery queries, no
PackageTransaction, no installed.toml writes, no repo/adapter persistence
(repo config is loaded via the dry-run path so a missing config is never
written). --motd renders a short, cache-backed summary for a login hook;
--refresh bypasses the cache. Existing update / update self / update all
/ update <component> semantics are unchanged.

Candidate ordering uses a new platform-layer rpm_evr_cmp (a faithful
rpmvercmp port) instead of semver, so real EVRs (epochs, .al4 releases,
two-segment versions) are compared the way dnf would. Applying upgrades is a
separate command (anolisa upgrade, issue #1411).

Related Issue

closes #1410

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• cosh-ng (cosh-ng)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• ckpt (ws-ckpt)
• memory (agent-memory)
• anolisa (anolisa-cli)
• skillfs (SkillFS)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For cosh-ng: cargo clippy --all-targets -- -D warnings and cargo fmt --check pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• For memory (Linux only): cargo clippy --all-targets -- -D warnings, cargo fmt --check, and cargo test pass
• For anolisa: cargo clippy --all-targets --locked -- -D warnings, cargo fmt --all --check, and cargo test --locked pass
• For skillfs: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

• cargo test -p anolisa-cli --locked (438 passed) and
  cargo test -p anolisa-platform --locked (77 passed).
• New update_check_* tests cover: flag parsing/rejection, JSON shape,
  rpm component update/noop, non-semver EVR upgrade detection, raw component
  unsupported_in_rpm_upgrade, missing target-profile defaults, item-level
  query/rpmdb errors, MOTD text/silence, cache round-trip + target-keying,
  and read-only repo-config load.
• New rpmvercmp / rpm_evr_cmp tests against RPM reference cases (epoch,
  leading zeros, ~/^, numeric-vs-alpha).
• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, and cargo doc --no-deps all clean.

Additional Notes

• update --check is registered as ReadOnly in the command policy so the
  MOTD hook can run it unprivileged (it is not gated behind the mutating-update
  root requirement).
• The target-profile reader is intentionally minimal (default_components
  only) since the repo-side profile schema is not finalized; it tolerates
  unknown keys for forward compatibility.
• Note: --check still issues dnf repoquery for candidates (a read-only,
  network-touching query), which is why the MOTD path is cache-backed.