feat(update): auto-apply by class; broker swaps, new brain lands adapters (fixes #336)

releases#336 (#331 SEAMLESS-UPDATES W7). A staged set whose class is in the
node's auto set now applies with no operator verb.

- Auto set (REQ-UPDATE-AUTO-CLASS-SET): DaemonConfig.auto_classes is its own
  vocabulary {brain_only, broker_compatible, broker_breaking, adapters} with a
  total map from UpdateClass. Default is brain_only + adapters. The
  full_auto_update boolean is removed and migrated: true = every class,
  explicit false = the empty set, absent = the default. The old key is read
  once and never written back. Both keys present: auto_classes wins and the
  broker logs it once at start. Unknown class names are dropped, not a parse
  failure.
- Broker is the swap initiator (REQ-UPDATE-AUTO-APPLY): a broker thread
  watches the release cache every stager writes. When a newly staged set's
  class applies unattended, it calls the new
  applyhost::apply_staged_in_broker. That is the SPLIT variant: the same
  prepare_apply gate and swap_and_record as both CLI paths, with the restart
  raised on the supervisor's own BrainRestart in-process. apply_staged would
  self-dial the broker's own socket. apply_staged_daemonless restarts nothing,
  so the old brain would keep running old code. The swap target is the
  canonical exe captured once at broker start (brainproc::canonical_exe, KH
  6.11). The prior version is the image the supervised brain announced, not
  the broker's own (older) build. Trial/promotion unchanged. A class outside
  the set, or one with no unattended mechanism yet (broker_* until #334), is
  OFFERED via REQ-UPD-4's consent notif and its bytes stay untouched. That
  closes the AutoApproved no-op.
- AUTO-SET SEAM closed: the unattended bundle leg offers a member
  (UPDATE_BUNDLE_MEMBER_OFFERED) when adapters are outside the auto set; the
  operator's own verb still applies.
- Heartbeat (REQ-UPDATE-RELEASE-HEARTBEAT): release_check_period_ms (default
  3600 s) plus additive jitter uniform in [0, 600) s. update_check_period_ms is
  untouched. The pump's update worker spawns `spt update fetch` (stage only)
  detached, no inherited handles, from the brain's launch path. The broker
  stamps that path as SPT_BRAIN_EXE. A nonzero exit (no gh) is a normal no-op.
  A finished fetch that staged something wakes one round to offer it.
- Order (REQ-UPDATE-AUTO-APPLY-ORDER): SubjectApply gains applied_by
  {version, counter}, written on every adapter move. The adapters leg runs
  only once the core swap is PROMOTED (Applied for exactly the staged
  version). The NEW brain spawns the hidden `spt update land-bundle` verb from
  its launch path, once per set (bundle-landed.json). Ordering is provable
  for moves; installs are out of scope (releases#344).

REQ-UPD-4's config unit row is rewritten in place (tag unmoved): the field it
read is gone. It now pins that a node can still be fully gated.

Co-authored by: todlando
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014j8UXzGXXsDsTJBYYUSCTC