merge: main into P11c (P11a's update/rollback, the bare-launch path, the Linux-only SOCK_CLOEXEC test)

Conflicts: ledger-cli main.rs (kept P11a's is_bare_launch; dropped the
"comes with P11" stubs), ledger-mcp local.rs (main's Linux gate on the
no-other-end test), docs/testing.md (both sections kept). `update` and
`rollback` are cfg(unix) in ledger-host (a running program's file cannot
be replaced on Windows), so main.rs says so on Windows (P11a step 5).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

README.md

@@ -97,6 +97,15 @@ create acme`, `wanderbooks connect claude --book acme` (or `connect codex`).
 Then talk to the agent; `wanderbooks gui acme` shows the books, and its
 Books menu backs them up, restores, starts new books and closes them.
 
+Updating: an AppImage, or a `wanderbooks` you put somewhere yourself, brings
+itself to the newest release with `wanderbooks update` (it checks the
+download against our release key, keeps the version it replaces, and the
+open books restart onto the new one when idle); `wanderbooks rollback` goes
+back, unless a book has since moved to a newer journal format. A `.deb`,
+`.rpm` or AUR install is updated by its package manager and `update` says
+so. The Linux packages are built here with `just package-linux`
+(docs/packaging.md); none is published yet.
+
 ## Developing
 
 Every tool the recipes use (Rust, just, Kani, Lean, cargo-mutants,