feat(update): channels, maintenance windows, min-version gate

Phase 6 of v0.3. The update agent now refuses to apply artifacts whose
channel doesn't match local policy, whose architecture differs from the
running host, or whose min_compatible_version is above the current
version. It also refuses to apply outside a configured maintenance window
unless --force is given.

New package update/pkg/config:
- config.Load parses /etc/kubesolo/update.conf (key=value, # comments,
  unknown keys ignored). Missing file is fine — fresh systems before
  cloud-init has run.
- ParseWindow handles "HH:MM-HH:MM" plus the wrapping midnight case
  (e.g. "23:00-01:00"). Empty input -> AlwaysOpen (no constraint).
  Degenerate zero-length windows never match.
- CompareVersions does a simple 3-component semver compare with the 'v'
  prefix optional and pre-release suffix ignored.
- 14 unit tests total.

update/pkg/image/image.UpdateMetadata gains three optional fields:
- channel ("stable", "beta", ...)
- min_compatible_version (refuse upgrade if current < this)
- architecture ("amd64", "arm64", ...)

update/cmd/opts.go reads update.conf and merges it into opts; explicit
--server / --channel / --pubkey / --maintenance-window CLI flags override
the file. New --force, --conf, --channel, --maintenance-window flags.
Precedence: CLI > config file > package defaults.

update/cmd/apply.go gains four gates in order:
1. Maintenance window — checked locally before any HTTP work; skipped
   with --force.
2. Channel — refused if metadata.channel doesn't match opts.Channel.
3. Architecture — refused if metadata.architecture != runtime.GOARCH.
4. Min compatible version — refused if FromVersion < min_compatible.
All gate failures transition state to Failed with a clear LastError.

cloud-init gains a top-level updates: block (Server, Channel,
MaintenanceWindow, PubKey). cloud-init.ApplyUpdates writes
/etc/kubesolo/update.conf from those fields on first boot. Empty block
leaves any existing file alone (so hand-edited update.conf survives a
reboot without cloud-init re-applying). 4 new tests cover empty / all /
partial / parent-dir-creation cases. full-config.yaml example updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update/pkg/config/config_test.go

@@ -0,0 +1,117 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConf(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "update.conf")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	return path
+}
+
+func TestLoadMissingReturnsEmptyConfig(t *testing.T) {
+	c, err := Load(filepath.Join(t.TempDir(), "does-not-exist.conf"))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c == nil {
+		t.Fatal("Load returned nil config")
+	}
+	if c.Server != "" || c.Channel != "" || c.MaintenanceWindow != "" || c.PubKey != "" {
+		t.Errorf("expected empty config, got %+v", c)
+	}
+}
+
+func TestLoadAllFields(t *testing.T) {
+	path := writeConf(t, `# comment line
+server = https://updates.example.com
+channel = stable
+maintenance_window = 03:00-05:00
+pubkey = /etc/kubesolo/pub.hex
+`)
+	c, err := Load(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if c.Server != "https://updates.example.com" {
+		t.Errorf("server: got %q", c.Server)
+	}
+	if c.Channel != "stable" {
+		t.Errorf("channel: got %q", c.Channel)
+	}
+	if c.MaintenanceWindow != "03:00-05:00" {
+		t.Errorf("maintenance_window: got %q", c.MaintenanceWindow)
+	}
+	if c.PubKey != "/etc/kubesolo/pub.hex" {
+		t.Errorf("pubkey: got %q", c.PubKey)
+	}
+}
+
+func TestLoadIgnoresUnknownKeys(t *testing.T) {
+	// Unknown keys must not be an error — supports forward-compat config
+	// fields added by newer agent versions.
+	path := writeConf(t, `server = https://x
+future_field = whatever
+channel = beta
+`)
+	c, err := Load(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if c.Server != "https://x" {
+		t.Errorf("server: got %q", c.Server)
+	}
+	if c.Channel != "beta" {
+		t.Errorf("channel: got %q", c.Channel)
+	}
+}
+
+func TestLoadStripsWhitespace(t *testing.T) {
+	path := writeConf(t, "   server   =   https://example   \n  channel=stable\n")
+	c, err := Load(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if c.Server != "https://example" {
+		t.Errorf("server: got %q (whitespace not stripped?)", c.Server)
+	}
+	if c.Channel != "stable" {
+		t.Errorf("channel: got %q", c.Channel)
+	}
+}
+
+func TestLoadIgnoresBlankAndCommentLines(t *testing.T) {
+	path := writeConf(t, `
+# this is a comment
+
+server = https://example
+   # indented comment
+channel = stable
+
+`)
+	c, err := Load(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if c.Server != "https://example" {
+		t.Errorf("server: got %q", c.Server)
+	}
+}
+
+func TestLoadRejectsMissingEquals(t *testing.T) {
+	// "noEqualsHere" with no '=' is a syntax error worth surfacing — likely
+	// indicates a corrupted config file.
+	path := writeConf(t, `server = https://example
+noEqualsHere
+`)
+	_, err := Load(path)
+	if err == nil {
+		t.Error("expected error on malformed line, got nil")
+	}
+}