fix(update): allow auto-update for OpenClaude builds on third-party providers

[0xfandom]

Summary

openclaude update exits immediately for every user running a third-party provider, never checking for or installing an update. Fixes #1404.

Root cause

src/cli/update.ts gated on the active runtime provider:

if (getAPIProvider() !== 'firstParty') {
  // "Auto-update is not available for third-party provider builds." → exit
}

The guard was inherited from upstream Claude Code, where auto-update reinstalls the Anthropic package — so a third-party user updating would overwrite their shim build with the upstream binary. But OpenClaude builds set PACKAGE_URL to @gitlawb/openclaude (scripts/build.ts), so update reinstalls the same OpenClaude package. Gating on the active provider therefore blocked all OpenClaude users for no reason.

Fix

Gate on package identity, not the active provider: block only when an Anthropic-packaged build is paired with a third-party provider. OpenClaude-packaged builds always update; the original safety case (Anthropic package + third-party provider) is preserved.

Decision extracted into a pure, exported isAutoUpdateBlockedForThirdParty(packageUrl, apiProvider):

package	provider	blocked
@gitlawb/openclaude	any (incl. third-party)	❌ no
@anthropic-ai/claude-code	third-party	✅ yes
@anthropic-ai/claude-code	firstParty	❌ no
missing	third-party	✅ yes (conservative)

Tests

src/cli/update.test.ts covers all four rows. All pass; full suite green.