Add ssr update subcommand for self-update

- bin/ssr-update: fast-forward `git pull` on the clone with safety guards
  (dirty tree, detached HEAD, divergent history all abort).
- Re-renders & reloads the launchd plist when launchd/ or bin/ssr* changed
  AND the schedule is currently active, so the cron picks up any plist
  template updates automatically.
- Reports VERSION delta, commit log, and new config keys introduced in
  config/ssr.conf.example so users can opt-in via `ssr config edit`.
- `--dry-run` shows would-be changes without pulling or touching launchd.
- Wired into bin/ssr dispatcher + README updated (Updating section, layout
  entry, command help line).

Co-authored-by: Cursor <cursoragent@cursor.com>

bin/ssr

@@ -29,6 +29,7 @@ Commands:
   install              First-time install: links binary, seeds config, schedules sync.
   sync                 Run a backup: brew bundle dump + mackup backup → cloud.
   restore [Brewfile]   Restore a machine: brew bundle + mackup restore + macOS defaults.
+  update [--dry-run]   Pull latest ssr code, refresh launchd if needed.
   schedule on|off      Enable/disable the scheduled launchd sync job.
   config show|edit     Print or edit the active config file.
   status               Show last sync time, cloud target, and scheduled state.
@@ -60,7 +61,7 @@ done
 
 cmd="$1"; shift
 case "$cmd" in
-    install|sync|restore|schedule|config|status)
+    install|sync|restore|update|schedule|config|status)
         target="$SSR_BIN_DIR/ssr-$cmd"
         [[ -x "$target" ]] || ssr::die "Subcommand not executable: $target"
         exec "$target" "$@"