feat(update): channels, maintenance windows, min-version gate

Phase 6 of v0.3. The update agent now refuses to apply artifacts whose
channel doesn't match local policy, whose architecture differs from the
running host, or whose min_compatible_version is above the current
version. It also refuses to apply outside a configured maintenance window
unless --force is given.

New package update/pkg/config:
- config.Load parses /etc/kubesolo/update.conf (key=value, # comments,
  unknown keys ignored). Missing file is fine — fresh systems before
  cloud-init has run.
- ParseWindow handles "HH:MM-HH:MM" plus the wrapping midnight case
  (e.g. "23:00-01:00"). Empty input -> AlwaysOpen (no constraint).
  Degenerate zero-length windows never match.
- CompareVersions does a simple 3-component semver compare with the 'v'
  prefix optional and pre-release suffix ignored.
- 14 unit tests total.

update/pkg/image/image.UpdateMetadata gains three optional fields:
- channel ("stable", "beta", ...)
- min_compatible_version (refuse upgrade if current < this)
- architecture ("amd64", "arm64", ...)

update/cmd/opts.go reads update.conf and merges it into opts; explicit
--server / --channel / --pubkey / --maintenance-window CLI flags override
the file. New --force, --conf, --channel, --maintenance-window flags.
Precedence: CLI > config file > package defaults.

update/cmd/apply.go gains four gates in order:
1. Maintenance window — checked locally before any HTTP work; skipped
   with --force.
2. Channel — refused if metadata.channel doesn't match opts.Channel.
3. Architecture — refused if metadata.architecture != runtime.GOARCH.
4. Min compatible version — refused if FromVersion < min_compatible.
All gate failures transition state to Failed with a clear LastError.

cloud-init gains a top-level updates: block (Server, Channel,
MaintenanceWindow, PubKey). cloud-init.ApplyUpdates writes
/etc/kubesolo/update.conf from those fields on first boot. Empty block
leaves any existing file alone (so hand-edited update.conf survives a
reboot without cloud-init re-applying). 4 new tests cover empty / all /
partial / parent-dir-creation cases. full-config.yaml example updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update/pkg/config/config.go

@@ -0,0 +1,83 @@
+// Package config parses /etc/kubesolo/update.conf — the persistent
+// configuration for the update agent. Each line is "key = value"; blank
+// lines and "#"-prefixed comments are ignored. Unknown keys are tolerated
+// (forward compatibility).
+//
+// Example:
+//
+//	# Where to look for updates
+//	server = https://updates.kubesolo.example.com
+//	channel = stable
+//
+//	# Only apply between 03:00 and 05:00 local time
+//	maintenance_window = 03:00-05:00
+//
+//	pubkey = /etc/kubesolo/update-pubkey.hex
+//
+// The file is populated on first boot by cloud-init (see the cloud-init
+// updates: block) and can be hand-edited afterwards.
+package config
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// DefaultPath is where update.conf lives on a live system.
+const DefaultPath = "/etc/kubesolo/update.conf"
+
+// Config holds the parsed update.conf values. Empty fields mean "not set" —
+// the caller's defaults apply.
+type Config struct {
+	Server            string
+	Channel           string
+	MaintenanceWindow string
+	PubKey            string
+}
+
+// Load reads and parses update.conf. A missing file returns an empty Config
+// (not an error) — fresh systems before cloud-init has run.
+func Load(path string) (*Config, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return &Config{}, nil
+		}
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	defer f.Close()
+
+	c := &Config{}
+	scanner := bufio.NewScanner(f)
+	lineNo := 0
+	for scanner.Scan() {
+		lineNo++
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		eq := strings.IndexByte(line, '=')
+		if eq < 0 {
+			return nil, fmt.Errorf("%s:%d: missing '=' in line: %q", path, lineNo, line)
+		}
+		key := strings.TrimSpace(line[:eq])
+		value := strings.TrimSpace(line[eq+1:])
+		switch key {
+		case "server":
+			c.Server = value
+		case "channel":
+			c.Channel = value
+		case "maintenance_window":
+			c.MaintenanceWindow = value
+		case "pubkey":
+			c.PubKey = value
+		}
+		// Unknown keys are silently ignored for forward compatibility.
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	return c, nil
+}