feat(update): channels, maintenance windows, min-version gate

Phase 6 of v0.3. The update agent now refuses to apply artifacts whose
channel doesn't match local policy, whose architecture differs from the
running host, or whose min_compatible_version is above the current
version. It also refuses to apply outside a configured maintenance window
unless --force is given.

New package update/pkg/config:
- config.Load parses /etc/kubesolo/update.conf (key=value, # comments,
  unknown keys ignored). Missing file is fine — fresh systems before
  cloud-init has run.
- ParseWindow handles "HH:MM-HH:MM" plus the wrapping midnight case
  (e.g. "23:00-01:00"). Empty input -> AlwaysOpen (no constraint).
  Degenerate zero-length windows never match.
- CompareVersions does a simple 3-component semver compare with the 'v'
  prefix optional and pre-release suffix ignored.
- 14 unit tests total.

update/pkg/image/image.UpdateMetadata gains three optional fields:
- channel ("stable", "beta", ...)
- min_compatible_version (refuse upgrade if current < this)
- architecture ("amd64", "arm64", ...)

update/cmd/opts.go reads update.conf and merges it into opts; explicit
--server / --channel / --pubkey / --maintenance-window CLI flags override
the file. New --force, --conf, --channel, --maintenance-window flags.
Precedence: CLI > config file > package defaults.

update/cmd/apply.go gains four gates in order:
1. Maintenance window — checked locally before any HTTP work; skipped
   with --force.
2. Channel — refused if metadata.channel doesn't match opts.Channel.
3. Architecture — refused if metadata.architecture != runtime.GOARCH.
4. Min compatible version — refused if FromVersion < min_compatible.
All gate failures transition state to Failed with a clear LastError.

cloud-init gains a top-level updates: block (Server, Channel,
MaintenanceWindow, PubKey). cloud-init.ApplyUpdates writes
/etc/kubesolo/update.conf from those fields on first boot. Empty block
leaves any existing file alone (so hand-edited update.conf survives a
reboot without cloud-init re-applying). 4 new tests cover empty / all /
partial / parent-dir-creation cases. full-config.yaml example updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloud-init/updates.go

@@ -0,0 +1,57 @@
+package cloudinit
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// DefaultUpdateConfPath is where the update agent expects to find its config.
+// Kept in sync with update/pkg/config.DefaultPath.
+const DefaultUpdateConfPath = "/etc/kubesolo/update.conf"
+
+// ApplyUpdates writes /etc/kubesolo/update.conf from the cloud-init
+// updates: block. Called once per boot; idempotent (overwrites any existing
+// file with the cloud-init values).
+//
+// If the updates: block is empty (all fields blank), the file is not
+// written — preserves any hand-edited update.conf on systems that aren't
+// managed via cloud-init.
+func ApplyUpdates(cfg *Config, confPath string) error {
+	if confPath == "" {
+		confPath = DefaultUpdateConfPath
+	}
+	u := cfg.Updates
+	if u.Server == "" && u.Channel == "" && u.MaintenanceWindow == "" && u.PubKey == "" {
+		// Nothing to write — leave any existing file alone.
+		return nil
+	}
+
+	if err := os.MkdirAll(filepath.Dir(confPath), 0o755); err != nil {
+		return fmt.Errorf("creating dir for %s: %w", confPath, err)
+	}
+
+	var sb strings.Builder
+	sb.WriteString("# Generated by KubeSolo OS cloud-init — edit this file or the\n")
+	sb.WriteString("# cloud-init source YAML; subsequent first-boots will regenerate it.\n")
+	if u.Server != "" {
+		fmt.Fprintf(&sb, "server = %s\n", u.Server)
+	}
+	if u.Channel != "" {
+		fmt.Fprintf(&sb, "channel = %s\n", u.Channel)
+	}
+	if u.MaintenanceWindow != "" {
+		fmt.Fprintf(&sb, "maintenance_window = %s\n", u.MaintenanceWindow)
+	}
+	if u.PubKey != "" {
+		fmt.Fprintf(&sb, "pubkey = %s\n", u.PubKey)
+	}
+
+	if err := os.WriteFile(confPath, []byte(sb.String()), 0o644); err != nil {
+		return fmt.Errorf("writing %s: %w", confPath, err)
+	}
+	slog.Info("wrote update.conf", "path", confPath)
+	return nil
+}