docs: add codflow-update runbook for existing self-hosted installs

[bighadj22]

What does this PR do?

Adds a new agent skill, codflow-update, that updates an existing self-hosted CodFlow install to the latest code from this repository's main branch — without re-running the full setup.

Why

Self-hosters who completed codflow-setup currently have no guided path to take upstream updates. Their wrangler.toml, root .env, and .dev.vars files are gitignored, so a plain git pull leaves their config silently out of sync whenever templates change (missing vars/bindings → broken deploys), and the only alternative today is redoing the whole setup from scratch.

What the runbook does

• Gates first: verifies a completed install exists, correct upstream remote, wrangler auth, clean working tree, and records a rollback point.
• Fetch + assess before changing anything: diffs HEAD..origin/main to categorize impact — new migrations, dependency changes, template changes, new secrets (via the env.ts diff), and which of the three workers need redeploying — then presents the plan.
• Merges with --ff-only (refuses cleanly if local commits exist); reinstalls dependencies only when the lockfile changed.
• Syncs gitignored config with updated templates: adds new bindings/vars/keys to the live files while preserving the user's resource IDs, worker names, and domains; backs up all live configs to ~/.codflow-backups/ first; re-runs the placeholder grep.
• New resources and secrets only: creates a resource only when the update introduces a new binding; never regenerates existing secrets (BETTER_AUTH_SECRET / MCP_LOGIN_TICKET_SECRET must stay identical across workers); never re-seeds a live store.
• Applies new D1 migrations before deploying code (incremental via wrangler's d1_migrations table), with a hard-stop rule on migration failure.
• Rebuilds before deploy: explicit npm run build for the dashboard (its deploy script does not build — PUBLIC_API_URL is baked at build time) and for theme01, so build failures surface before any deploy; a failed build blocks the deploy.
• Verifies with the smoke-test table (sign-in check with the mandatory Origin header), then prints a closing summary with rollback paths (wrangler rollback, old HEAD, config backups).

The agent reports every step to the user in plain language as it goes, since the user may be a non-developer.

Also included:

• codflow-setup's closing summary now tells new installs how to get future updates ("ask your agent to update CodFlow") instead of re-running setup.
• README Quick Setup section links the runbook for existing installs.

Both skill directories (.agents/skills/ and .opencode/skills/) carry identical copies, matching the existing codflow-setup convention.

Related issues

None — new capability addressing recurring self-hoster feedback about taking updates.

How to test

Documentation-only change (no code paths touched). To review:

• Read .agents/skills/codflow-update/SKILL.md end to end; verify each command matches the repo's actual scripts (cod-server/scripts/d1.mjs, deploy scripts, .env.example keys).

• Verify both directory copies are identical: diff .agents/skills/codflow-update/SKILL.md .opencode/skills/codflow-update/SKILL.md

• I ran npm run typecheck and npm test in the affected package(s)

  • Not applicable — docs/skills only, no package code changed.

Checklist

• No secrets, API keys, or live credentials are introduced
• Tests cover the change (or an existing test covers it) — N/A, documentation only
• README/docs claims match the implemented behavior (no unbuilt features claimed)
• Conventional commit message (docs:)

Areas affected

docs (agent skills, README)