fix(ci): harden weekly-update — allowedTools, two-phase update, diff validation

[jdalton]

Replace --dangerously-skip-permissions with --allowedTools whitelist, two-phase haiku/sonnet, SFW_BIN PATH wrapper, post-agent diff validation.

---

Note

Medium Risk
Medium risk because it restructures the automated dependency-update workflow (new AI agent permissions, signing, gating, and test/fix phases), which could prevent updates/PRs from being created or allow unexpected file changes if misconfigured.

Overview
Hardens and restructures the weekly-update.yml dependency-update job to run in two phases: a fast Claude pass to update dependencies, then pnpm build/pnpm test, and an escalated Claude pass to fix failures.

Replaces --dangerously-skip-permissions with an explicit --allowedTools whitelist, adds GPG commit signing setup/cleanup, and wraps pnpm execution via a SFW_BIN shim for consistent tooling.

Adds a final status gate plus a post-run diff validation step that blocks push/PR creation unless only expected dependency/config or code/test files changed, and expands uploaded artifacts to include separate update/fix logs and build/test logs.

^{Reviewed by Cursor Bugbot for commit 692f2ec. Configure here.}