fix(update): make permission error actionable

[ryanfowler]

Summary

• include the replacement directory in unsafe-permission errors
• provide chmod and private-directory remediation guidance
• document the update destination requirement

Validation

• go test -v -parallel 8 ./...
• go test ./internal/update
• go build .
• staticcheck ./...
• git diff --check