feat: add update and cleanup lifecycle subcommands

[vyncint]

Adds one-command lifecycle management for the whole stack, mirroring apple/container's own update-container.sh / uninstall-container.sh -k|-d scripts (which is what prompted this).

update

update                    self-update the driver to the latest release, then re-run setup
update --version vX.Y.Z    pin a specific driver release
update --all               also update OpenShell (brew) and apple/container (its updater)
update --no-setup          replace the binary only, don't restart the service

Resolves the target tag (GitHub releases/latest or --version), downloads the darwin/arm64 asset, verifies its sha256 against checksums.txt, extracts the binary, and replaces the running one in place — atomic rename within the prefix dir (works while the old binary is still running), with a sudo install fallback for a root-owned prefix. Then re-runs setup so the launchd service restarts on the new binary. --all additionally runs brew upgrade openshell and apple/container's update-container.sh.

cleanup (uninstall is now an alias)

Layers exactly like apple/container's uninstaller:

cleanup            remove the driver service + gateway.env wiring   (data kept — the old `uninstall`)
cleanup -d         + remove driver state, socket dir, vmnet network, pulled images
cleanup --all      + brew uninstall openshell, + apple/container's uninstaller (-k)
cleanup --all -d   full teardown, passing -d through to apple/container's uninstaller

-k/--keep-data is the default; a bare command never touches apple/container. apple/container's uninstaller needs sudo, so it (and brew) run attached to the terminal to prompt.

Design notes

• Uninstall() became Cleanup(CleanupOptions); the CLI uninstall subcommand delegates to it, so existing behavior (driver-only, data kept) is unchanged.
• The Homebrew probe, the apple/container uninstaller path, and the OpenShell var dir are injectable fields, so the cleanup tests assert the exact command sequence per flag combo without touching any real system path (no risk of a test nuking /opt/homebrew/var/openshell).

Verification

• New unit tests: cleanup command-issuance for each flag combo (keep / -d / --all / --all -d, and the OpenShell-absent path) + update's checksum verification and tar.gz extraction.
• go test -race ./..., golangci-lint (0 issues), make sec (govulncheck + gosec + gitleaks) all clean.
• Live: ran the real update --version v0.2.3 --no-setup pipeline against the actual GitHub release — downloaded, checksum-verified, extracted, and replaced a throwaway binary successfully (Go's HTTP client had no trouble with the GitHub CDN). The running gateway/driver was left untouched. Destructive cleanup paths are covered by the command-issuance unit tests rather than a live teardown, to preserve the working install.