Summary

Adds an `anvil update` subcommand that swaps the running binary for the latest release from the configured server.

• `anvil update` — fetches `/runner/version`, compares to the embedded build version, downloads `/runner/download?os=&arch=` if different, verifies SHA256 against `/runner/checksums`, then atomically replaces the executable in place.
• `–check` — print whether an update is available, don’t install.
• `–force` — reinstall even when versions match.
• `–no-verify` — skip checksum (escape hatch).

Reuses the existing runner-download endpoints — no new server work.

Test plan

• `cargo test` (82 passing, 7 new for checksum parsing / platform mapping / SHA256 verify)
• `anvil update –check` against prod
• `anvil update` against prod (or a staging deploy) and verify the new binary runs
• `anvil update` from a location without write permission → expect a clear “try sudo” error

🤖 Generated with Claude Code