chore(omp): automate reviewed compatibility update PRs

[tomdps]

Parent: #864

Depends on: #869

Objective

Open human-reviewed OMP release-update PRs automatically.

Scope

• Add scripts/update-omp-release.js with two exact modes: node scripts/update-omp-release.js --version <X.Y.Z|latest> --check verifies the checked-in contract without writing, and the same command with --write canonically regenerates only src/agent-cli-provider/omp-release.ts. Reject non-semver tags, drafts, prereleases, missing/duplicate supported assets, package/tag version disagreement, a non-MIT package license, or a candidate not newer than the merged pin; latest means the newest stable GitHub Release.
• Query the official GitHub Releases API, require the six supported Unix asset names, stream each asset through a 256 MiB cap into a temporary file, compute SHA-256 locally, and require equality with the API's sha256: digest when present. Follow only HTTPS redirects from GitHub to GitHub-owned release-object hosts. Delete temporary downloads on success or failure. Extra upstream assets, including Windows, are recorded in diagnostics but do not enter the supported matrix.
• Render the release contract deterministically with {version,tag,packageName,license,assets} and a generated-file banner. Registry install text, static probing, Docker build arguments, fixtures, and operator output continue to read this one module; the updater never edits protocol/adapter/session code to make a candidate pass.
• Add package scripts omp:update, omp:release:check, and test:omp:update. Unit tests use a local fake Releases API and byte fixtures to cover digest match/mismatch, redirect allowlisting, size bounds, version ordering, prerelease exclusion, canonical output, and no-change idempotence; they never depend on live GitHub.
• Add scripts/omp-update-pr.js as the testable orchestration layer. node scripts/omp-update-pr.js --version <X.Y.Z|latest> --dry-run emits a closed JSON plan without Git/GitHub writes; omitting --dry-run creates/looks up the deterministic branch, commit, draft PR, and workflow dispatches. Keep the workflow YAML declarative—do not duplicate update policy in shell.
• Add .github/workflows/omp-update.yml on a daily schedule and workflow_dispatch with optional exact version. Its prepare job invokes the checked-in main-branch orchestration script, creates deterministic branch automation/omp-v<X.Y.Z>, commits only the generated contract as fix(omp): support v<X.Y.Z>, and opens a draft PR with that title. If the merged pin is current, exit successfully; if the same version branch/PR exists, report it and never force-push or overwrite human commits.
• Use only the repository GITHUB_TOKEN with contents:write, pull-requests:write, and actions:write; pin third-party actions by full SHA. The write-capable job hashes but never executes the downloaded OMP binary. After opening the PR, explicitly dispatch the ordinary CI workflow and the offline OMP conformance workflow at the candidate branch because a PR created by GITHUB_TOKEN does not itself trigger pull_request workflows.
• Execute candidate OMP binaries only in a separate no-secrets job with contents:read, persist-credentials:false, temporary HOME/config roots, and the local keyless model fixture from Subissue 7. A final write-only reporting job posts links and pass/fail state to the draft PR without consuming candidate-controlled output as shell or GitHub API arguments.
• Never auto-approve, auto-merge, or silently widen the runtime version range. A maintainer resolves protocol/help/model/session drift in the draft, obtains green ordinary CI plus offline conformance, reviews the release notes and asset provenance, then marks it ready and merges. The Conventional Commit title causes the merged compatibility bump to publish as a Zeroshot patch.
• Keep OMP's own autoUpdate disabled in the Zeroshot overlay. Runtime machines do not self-update and unknown OMP versions still fail closed; “automatic update” means automatic candidate discovery/PR creation followed by human certification.

Primary files

• src/agent-cli-provider/omp-release.ts
• scripts/update-omp-release.js
• scripts/omp-update-pr.js
• .github/workflows/omp-update.yml
• the offline OMP conformance workflow/runner from Subissue 7
• release-updater fixtures and tests

Acceptance

• A fake newer stable release produces one canonical contract change and one draft PR/branch; running discovery again is a no-op and preserves any maintainer commits.
• Draft/prerelease/older/equal releases, wrong asset names, oversized assets, digest mismatch, non-GitHub redirects, and package/tag disagreement create no branch and expose an actionable failed workflow summary.
• A protocol-compatible candidate gets ordinary CI and offline conformance runs at its immutable branch SHA. An incompatible candidate remains a draft with red evidence; automation never changes code or merges it to suppress the failure.
• Merging a reviewed candidate changes the exact accepted host version, Docker asset/digest, install remediation, and certification fixture from the one release contract. No runtime network check or self-update occurs during a Zeroshot task.

Verification

npm run test:omp:update

node scripts/update-omp-release.js --version 17.2.1 --check

Source contract

v17.2.1 release API, package metadata

Delivery constraints

Keep this issue independently mergeable and OMP opt-in. Do not flip the default here unless this is issue I. Fix only this slice; do not add a second harness registry or retain compatibility shims. Validators inspect files and run the commands above directly; never put Git commands in validator prompts.