feat: D1 Part 2 — agent self-update Go plumbing (op class, opsign, executor, commit, report)

- reconcile: ClassAgentUpdate op class; always Destructive (no provenance
  blesses replacing the root-adjacent binary). classify test + companion
  (TestClassify_AgentUpdateAlwaysDestructive).
- opsign: `-op agent_update` with -agent-version + -sha256 (isHex64-validated);
  params {version,sha256}. isHex64 test (Group D).
- config: SelfUpdateConfig{URLTemplate,Username,Token,StateDir,DwellSeconds}
  + WithDefaults + Token redaction.
- internal/selfupdate: Executor (download → verify vs the SIGNED sha → sudo -n
  wrapper `apply`; sha is the only integrity root — mismatch refuses + removes,
  agent untouched); Manager (startup dwell → `commit`; version-mismatch → no
  commit + loud WARN + marker left for report visibility; shutdown-before-dwell
  leaves pending). WrapperRunner seam → tests never shell out.
- hub report: additive selfupdate_pending(+version) via SetSelfUpdateReporter
  seam; both omitempty (Wireguard precedent) so the cross-repo golden contract
  stays byte-stable — no hub change.
- capability manifest: 3 non-critical FELHOM_SELFUPDATE probes.
- main.go: updateExec appended to the executor chain; commit-manager wired to
  the report seam + MaybeCommit goroutine after core init.

Tests: Group A (executor happy/sha-mismatch+companion/bad-params/wrapper-fail),
B (agent_update rides the real gate: pinned-key executes, non-pinned +
retarget rejected), C (commit/version-mismatch/no-pending/shutdown), D (opsign).
C2 companion red-proof verified (neutered Go verify → bad binary reaches apply
→ test fails), reverted. Full go test ./... green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/reconcile/classify.go

@@ -39,6 +39,14 @@ const (
 	// recovery key authorizes ONLY this; the operational key authorizes this + ordinary
 	// destructive ops.
 	ClassKeyRotation OpClass = "key_rotation"
+
+	// Agent self-update (TASK D1) — replacing the root-adjacent host binary. Destructive-class by
+	// definition (the operator signs the exact version + sha256; the pinned sha is the ONLY
+	// integrity root — neither hub nor Gitea can substitute a binary). Operational-key only, like
+	// every ordinary destructive op. Note the classifier's default case already fails safe to
+	// Destructive for unknown classes — this named constant documents the class and keeps the
+	// signed-op vocabulary explicit, it does not (and must not) loosen anything.
+	ClassAgentUpdate OpClass = "agent_update"
 )
 
 // Disposition is the classifier verdict.
@@ -107,6 +115,10 @@ func Classify(class OpClass, prov Provenance) Disposition {
 		return Destructive
 	case ClassKeyRotation:
 		return Destructive
+	case ClassAgentUpdate:
+		// Never benign — no agent-internal provenance can make replacing the agent binary
+		// unsigned-safe (a compromised process must not be able to self-bless an update).
+		return Destructive
 	default:
 		return Destructive // fail safe: an unrecognized op is treated as destructive
 	}