feat(ops): add opt-in auto-update enabler

[typelicious]

What changed

• adds an opt-in auto-update policy block and exposes eligibility in GET /api/update
• adds the foundrygate-auto-update helper for safe operator-triggered apply flows
• updates README, onboarding, troubleshooting, and roadmap docs for the conservative auto-update path

Why

• completes the next v0.7.x operations slice without introducing silent self-updates
• keeps updates helper-driven, explicit, and blocked by default for major releases

How verified

• python3 -m compileall foundrygate tests
• PYTHONPATH=. ./.venv-check-313/bin/pytest -q
• ./.venv-check-313/bin/ruff check foundrygate/updates.py foundrygate/config.py foundrygate/main.py tests/test_updates.py tests/test_config.py
• ./.venv-check-313/bin/ruff format --check foundrygate/updates.py foundrygate/config.py foundrygate/main.py tests/test_updates.py tests/test_config.py
• bash -n scripts/foundrygate-auto-update scripts/foundrygate-install scripts/foundrygate-uninstall scripts/foundrygate-update scripts/foundrygate-update-check
• /usr/bin/git diff --check