v0.86.0: Phase 2 managed updates — floor-driven auto-update

The controller honors an operator-enforced minimum version (FLOOR) on the hub
report ACK and auto-updates to the floor when below it (managed default, no click),
reusing the Phase 1 in-guest-pull + agent-swap + rollback. Latest stays the opt-in
button; the floor is the auto-target, never latest.

- pusher.go: PushResponse += min_controller_version, latest_version (existing ACK seam)
- main.go: OnPushResponse → updater.SetFloor + MaybeAutoUpdate (rides report cycle)
- updater.go: SetFloor/GetFloor + MaybeAutoUpdate reusing performUpdate (auto-floor);
  no-op at/above floor, floor>latest, dev/no-agent/backup; no flap (in-mem+persisted)
- settings UI (HU): floor display + auto restart-poll during an auto-update
- tests: below/at/floor>latest/no-flap/raised-floor; below-floor red-proof verified
- no agent change (reuses Phase 1 POST /controller/swap)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FSZmmSFVzGwEzhYmxbkgBK

CONTEXT.md

@@ -7,7 +7,22 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-06-26 (v0.84.0 — catalog-driven initial-login extraction; show an app's auto-generated password on its page)
+Last updated: 2026-06-27 (v0.86.0 — Phase 2 managed updates: floor-driven auto-update)
+
+> **2026-06-27 — v0.86.0 (deployed on 9201): Phase 2 managed updates — controller-version FLOOR.**
+> On top of the Phase 1 opt-in "update to latest" button, the controller now honors an operator-enforced
+> **minimum version (FLOOR)** delivered on the hub **report ACK** (`min_controller_version` +
+> `latest_version`; `internal/report/pusher.go` `PushResponse`). `OnPushResponse` →
+> `updater.SetFloor()` + `updater.MaybeAutoUpdate()` (rides the report cycle — no new timer). Below the
+> floor → **auto-update to the floor** (reuses Phase 1 `performUpdate`: in-guest pull → agent swap →
+> rollback; `initiatedBy="auto-floor"`). At/above floor → nothing (does NOT chase latest — that's the
+> button). Guards: dev/no-agent/backup → skip; floor must be pullable (floor ≤ latest; floor>latest →
+> warn+noop); one attempt per below-floor condition (in-mem + persisted state) → no flapping. Floor source
+> + operator UI are hub-side (felhom-hub v0.15.0: per-customer override + global default + report ACK).
+> **No agent change** (reuses Phase 1 `POST /controller/swap`). Day-0 now ships current (golden rebuilt at
+> 0.85.1) AND stays current (floor) — the fleet-currency story is closed. Live: dogfood 0.85.1→0.86.0 via
+> the button, then floor 0.87.0 → auto 0.86.0→0.87.0 (no click).
+
 
 > **2026-06-26 — v0.84.0 (deployed on 9201): show an app's auto-generated first-login on its page.**
 > General, catalog-driven mechanism: `.felhom.yml initial_credentials: {file, format json|regex|plain,