Add a runtime code-upgrade path so shipped images can pick up new code without
rebuilding or shipping an overlay image.

- launcher/coderai-upgrade: in-image upgrader. Shallow-clones the configured ref
  (default: production branch of the nexlab repo), compares its
  codai/__init__.py __version__ against the installed one, and rsyncs the fetched
  tree over /opt/coderai/app when newer (or with --force). Mirrors the build's
  path exclusions (.git/venv*/dist/…). Exit 0=updated, 10=up-to-date, else error.
  Auth over HTTPS by default, or SSH when a key path is provided.
- run_oci.sh: add --upgrade/--force/--upgrade-ref/--upgrade-repo/--ssh-key. Runs
  the in-image upgrader in a throwaway container (as root, --entrypoint) and, only
  when it reports an update, docker-commits the result back onto the SAME image
  tag — no rebuild, no new overlay. SSH key is bind-mounted read-only.
- Dockerfile.update / Dockerfile.oci: install /usr/local/bin/coderai-upgrade.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz