feat: vendor update/diff/remove with per-type change reports

- update advances the pinned rev, rewrites the external area via staging+swap,
  reports added/changed/removed per type; include mode holds its selection,
  vanished include entries abort loudly with the tree untouched
- all mode pulls new upstream items automatically; collision checks re-run on
  every update and honor the rename map
- diff is strictly read-only (temp dir outside the repo) and surfaces new
  upstream items as available-but-not-selected
- remove deletes external area + lockfile entry and prunes empty external root
- update --all reports per source and surfaces every failure

internal/cli/update.go

@@ -0,0 +1,66 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/m3tam3re/agent-lib/internal/vendor"
+)
+
+func newVendorUpdateCmd() *cobra.Command {
+	var all bool
+	cmd := &cobra.Command{
+		Use:   "update [<name>]",
+		Short: "Fetch the latest revision of the pinned ref and rewrite the external area",
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if all {
+				if len(args) != 0 {
+					return fmt.Errorf("--all takes no source name")
+				}
+				if err := vendor.UpdateAll(".", cmd.OutOrStdout()); err != nil {
+					return fmt.Errorf("vendor update: %w", err)
+				}
+				return nil
+			}
+			if len(args) != 1 {
+				return fmt.Errorf("specify a source name or --all")
+			}
+			if _, err := vendor.Update(".", args[0], cmd.OutOrStdout()); err != nil {
+				return fmt.Errorf("vendor update: %w", err)
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&all, "all", false, "update every source and report per source")
+	return cmd
+}
+
+func newVendorDiffCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "diff <name>",
+		Short: "Compare upstream against the current selection without modifying anything",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if _, err := vendor.Diff(".", args[0], cmd.OutOrStdout()); err != nil {
+				return fmt.Errorf("vendor diff: %w", err)
+			}
+			return nil
+		},
+	}
+}
+
+func newVendorRemoveCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "remove <name>",
+		Short: "Delete a source's external area and lockfile entry",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if err := vendor.Remove(".", args[0], cmd.OutOrStdout()); err != nil {
+				return fmt.Errorf("vendor remove: %w", err)
+			}
+			return nil
+		},
+	}
+}