feat: vendor update/diff/remove with per-type change reports

- update advances the pinned rev, rewrites the external area via staging+swap,
  reports added/changed/removed per type; include mode holds its selection,
  vanished include entries abort loudly with the tree untouched
- all mode pulls new upstream items automatically; collision checks re-run on
  every update and honor the rename map
- diff is strictly read-only (temp dir outside the repo) and surfaces new
  upstream items as available-but-not-selected
- remove deletes external area + lockfile entry and prunes empty external root
- update --all reports per source and surfaces every failure

internal/cli/vendor.go

@@ -17,6 +17,9 @@ func newVendorCmd() *cobra.Command {
 	cmd.AddCommand(newVendorAddCmd())
 	cmd.AddCommand(newVendorListCmd())
 	cmd.AddCommand(newVendorInspectCmd())
+	cmd.AddCommand(newVendorUpdateCmd())
+	cmd.AddCommand(newVendorDiffCmd())
+	cmd.AddCommand(newVendorRemoveCmd())
 	return cmd
 }