feat: multi-agent-mux-update skill and in-place install (Issue #72)

The update is a skill (decision 4); deploy/update.sh and the installed
.mam_deploy/update.sh are gone.

- Phase 1 (installed code, update.sh): publish the update marker under the
  exclusive admission lock; refuse before any change while a running row, a
  live herdr agent in the workspace on any running server, an open job
  (unreadable JSON included, dry_run not), a live loop marker or a
  monitor.lock held by a monitor the skills did not start (U3) is there - the
  calling agent (server + pane, its row and one running job) excepted
  (lib_py/update.py precheck, decisions 1 and 7). Stop the monitor (TERM, then
  KILL and restart it if it does not end; decision 2), handle a leftover
  backup by its state (U4), back up .agents, .mam_deploy, root files, .venv,
  the installer's .mam files and the registry (SQLite backup API under the
  registry lock) into .mam/update-backup/, then exec a copy of
  install_phase.sh outside the tree (decision 5).
- The copy (no lib.sh/lib_py, bash 3.2) runs the installer in place; on
  failure it restores the backup and restarts the monitor from the restored
  tree; on success it runs phase 2, post_update.sh of the new tree, which
  converts the registry with lib_py.registry_format and restarts the monitor
  if it ran. The backup and the marker are removed at the end.
- install.sh updates in place (decisions 3, 4, 9): install_state keys are set,
  one line each; no updater is installed and an old one (.mam_deploy/update.sh,
  or a root update.sh the manifest lists) is removed; framework files the new
  version no longer ships are deleted when unmodified, kept and listed when
  modified, and dropped from base/, the manifest and asset_hashes.txt; a local
  source's .mam is not staged. remove.sh knows the new skill; CI shellchecks
  its scripts; docs point at the skill.
- test_issue8_update_state and test_deploy_layout td6/td27 run the skill.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/README.md

@@ -9,7 +9,7 @@ This directory contains packaging templates and installation scripts to deploy t
 *   **`install.sh`**: A self-contained, idempotent remote shell installer (via curl) that checks system requirements (`herdr`, `python3`), sets up a local python virtual environment (`.venv`), and performs 3-way refresh with key-level registry merge (Rev.2).
 *   **`install_mam.sh`**: A local-clone installer that copies rules/skills (`.agents/`), `AGENTS.md`, manifests, and asset hashes into target projects.
 *   **`lib_ownership.sh`**: Single source of truth for framework-owned files and key-level registry files.
-*   **`update.sh`**: In-place updater script installed into target `.mam_deploy/update.sh`.
+*   **Updates**: installed workspaces update with the `multi-agent-mux-update` skill (`bash .agents/skills/multi-agent-mux-update/scripts/update.sh`).
 *   **`remove.sh`**: Clean uninstaller script installed into target `.mam_deploy/remove.sh`.
 *   **`generate-env.sh`**: Environment configuration bootstrap helper.
 *   **`INSTALL.md`**: Detailed installation and quick-start user manual.
@@ -40,7 +40,7 @@ bash deploy/install_mam.sh --target /path/to/your/project
 Refer to **`INSTALL.md`** inside this directory for the full instructions and workflows.
 
 > [!NOTE]
-> `install_mam.sh` automatically deploys `.mam_deploy/update.sh` and `.mam_deploy/remove.sh` into target workspaces, recording install manifests and asset hashes to enable clean updates and uninstalls.
+> `install_mam.sh` automatically deploys `.mam_deploy/remove.sh` into target workspaces, recording install manifests and asset hashes to enable clean updates and uninstalls.
 
 ### 3. Custom Fork / Private Mirror Installations
 If you run a private mirror or fork, you can override the source URLs during installation using environment variables:
@@ -53,7 +53,7 @@ curl -fsSL https://my-mirror.example.com/.../install.sh \
     bash
 
 # Updating an existing workspace against a mirror
-MAM_INSTALLER_URL=https://my-mirror.example.com/.../install.sh bash deploy/update.sh
+MAM_INSTALLER_URL=https://my-mirror.example.com/.../install.sh bash .agents/skills/multi-agent-mux-update/scripts/update.sh
 ```
 
 ### 4. Registering as a Workspace Plugin