#1132 Harden the CLI update path so a future artifact-host migration can't strand clients again

Summary

Follow-up to #1130, deliberately scoped out of that fix. #1130 stranded every binary built before the artifact-host rename: swamp update failed with HTTP 522, permanently, because the dead hostname is compiled in as both the download base URL and as TRUSTED_ARTIFACT_HOST. It was fixed at the edge (the only thing that can reach an already-shipped binary).

Nothing here would have helped a single stranded user — that's precisely why it wasn't bundled into the #1130 fix. These changes protect the next migration.

Motivation

Three weaknesses in the update path turned a host rename into a permanent outage rather than a recoverable one:

1. The error is a dead end. http_update_checker.ts throws a bare Failed to check for updates: HTTP ${status}. A user hitting a 522 gets no indication that reinstalling would fix it, or from where.
2. Autoupdate fails silently. runBackgroundUpdate() in src/cli/commands/update.ts catches every error, records it at debug level, and exits 0 for anything except "permission denied". src/cli/mod.ts likewise only surfaces the permission case on later invocations. A host failure produces zero user-visible output, indefinitely.
3. There is no self-rescue. The host is compile-time only — no env override anywhere in src/domain/update/ or src/infrastructure/update/ — so a stranded user's only recourse is a manual reinstall.

Proposed

• Actionable 5xx/522 error. Tell the user how to recover (reinstall from the current host) instead of surfacing a bare status code. No test currently asserts that message string, so it's free to change.
• A remediation branch in doctor install. src/presentation/renderers/doctor_install.ts prints the last autoupdate error verbatim and flips status to UNHEALTHY, but only has guidance for the writable/permission case. A host/HTTP failure gets no advice.
• Consider surfacing repeated autoupdate failures. N consecutive failures should be visible somewhere the user actually looks, rather than only in doctor install, which nothing prompts them to run.
• An env override for self-rescue (e.g. SWAMP_ARTIFACT_HOST), turning "permanently stranded, must reinstall" into "set one env var". Precedent exists: serve.ts already has a runtime-configurable TRUSTED_HOSTS seeded from SWAMP_TRUSTED_HOSTS.

Note on the "multi-host allowlist" idea

The original issue suggested replacing the single TRUSTED_ARTIFACT_HOST with an allowlist that retains prior hosts. On its own that does not prevent recurrence — a shipped binary cannot know a future hostname, so retaining past hosts doesn't help it survive the next rename. It only helps if today's binaries already trust the next host (pre-seeding), or if trust is decoupled from the hostname entirely (signature verification). Worth deciding deliberately rather than inheriting the framing from #1130.

Existing allowlist prior art if it goes ahead: VERIFIED_REPO_HOSTS in extension_rubric_scorer.ts (exact-match ReadonlySet), PUBLIC_HOST_ALLOWLIST in content_redactor.ts (suffix match).

Related

• #1130 — the outage this follows from
• #1131 — a separate silent-failure bug in the same code path