Add ssr update subcommand for self-update

- bin/ssr-update: fast-forward `git pull` on the clone with safety guards
  (dirty tree, detached HEAD, divergent history all abort).
- Re-renders & reloads the launchd plist when launchd/ or bin/ssr* changed
  AND the schedule is currently active, so the cron picks up any plist
  template updates automatically.
- Reports VERSION delta, commit log, and new config keys introduced in
  config/ssr.conf.example so users can opt-in via `ssr config edit`.
- `--dry-run` shows would-be changes without pulling or touching launchd.
- Wired into bin/ssr dispatcher + README updated (Updating section, layout
  entry, command help line).

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -49,6 +49,7 @@ export PATH="$HOME/.local/bin:$PATH"
 ssr install              First-time install: link binary, seed config, schedule sync
 ssr sync                 One-shot backup → cloud
 ssr restore [Brewfile]   Restore the machine; Brewfile defaults to the cloud copy
+ssr update [--dry-run]   Pull latest ssr code, refresh launchd if needed
 ssr schedule on|off      Enable/disable the daily launchd job
 ssr config show|edit     Show or edit the active config
 ssr status               Show config, cloud target, last sync, schedule state
@@ -146,6 +147,30 @@ log show --predicate 'process == "ssr"' --last 1h
 
 ---
 
+## Updating
+
+Updates happen on three independent layers:
+
+**Tool code (this repo).** Self-update via `ssr update`:
+
+```bash
+ssr update            # git pull --ff-only on the clone, then refresh side-effects
+ssr update --dry-run  # show what would change, don't pull
+```
+
+`ssr update` will:
+
+- Refuse if the working tree is dirty or HEAD is detached.
+- Fast-forward only — never rewrites history.
+- Re-render and reload the launchd plist if `launchd/` or `bin/ssr*` changed *and* the schedule is currently active.
+- Print added config keys when `config/ssr.conf.example` gained new options.
+
+**Backup data (cloud drive).** Refreshed automatically by the scheduled `ssr sync`. The previous `Brewfile` is preserved as `Brewfile.bak`; deeper history is provided by the cloud provider's built-in version retention (iCloud Drive, Dropbox, …). Trigger an on-demand sync with `ssr sync`.
+
+**Dependencies (Homebrew, mackup).** `ssr sync` runs `brew upgrade` and `brew cleanup` when `SSR_BREW_UPGRADE=true` / `SSR_BREW_CLEANUP=true` (both default `true`). Set them to `false` in `ssr.conf` to keep snapshots without auto-upgrading installed packages.
+
+---
+
 ## Project layout
 
 ```
@@ -154,6 +179,7 @@ log show --predicate 'process == "ssr"' --last 1h
 ├── bin/
 │   ├── ssr                 # CLI dispatcher
 │   ├── ssr-install         # Local install + scheduling
+│   ├── ssr-update          # Self-update (git pull + launchd refresh)
 │   ├── ssr-sync            # Backup to cloud
 │   ├── ssr-restore         # Rebuild a Mac from the backup
 │   ├── ssr-schedule        # launchd on/off/status