Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/update.ts`:
- Around line 572-585: The code currently restores credential permissions to a
hard-coded 0o600; instead use the original mode stored in
payload.credentialsMode so we truly preserve original permissions. In the block
that calls chmodSyncImpl(payload.credentialsFilePath, 0o600) replace the
hard-coded mode with payload.credentialsMode, and update the warning messages
that mention "Restored to 0600" or formatMode(currentMode) to use
formatMode(payload.credentialsMode) so the log reflects the actual restored
mode; keep the existing try/catch and error-string logic unchanged and continue
pushing messages into warnings.
- Around line 506-514: The resolveUpdateLogFilePath function currently returns a
path inside baseDir but doesn't ensure baseDir exists; modify
resolveUpdateLogFilePath to create the directory (e.g., using fs.mkdirSync or
fs.promises.mkdir with { recursive: true }) for baseDir before returning the
joined "update.log" path so subsequent appendWorkerLog() calls won't fail with
ENOENT; perform the mkdir in the same function (referencing credentialFilePath,
baseDir, and resolveHomeDirectory) and surface or log any unexpected errors as
appropriate.

In `@src/nemoclaw.ts`:
- Line 3776: The callback passed to printUpdateUsage currently forwards the
possibly-undefined line directly to console.error, which causes literal
"undefined" to appear; update the callback used where printUpdateUsage((line?:
string) => console.error(line)) is called so it normalizes undefined to an empty
string (or only logs when line is defined) before calling console.error (e.g.,
replace direct forwarding with a wrapper that does console.error(line ?? '') or
conditional logging) targeting the invocation that passes the anonymous callback
to printUpdateUsage.

---

Nitpick comments:
In `@test/cli.test.ts`:
- Around line 193-196: The test "unknown onboard option exits 1" currently only
asserts exit code; update it to also assert the parser-specific error message by
checking that the output (from the run(...) result object returned by run)
contains the string "Unknown onboard option" in addition to
expect(r.code).toBe(1); locate the test case in test/cli.test.ts (the it block
with run("onboard --invalid-opt")) and add an assertion similar to the
neighboring cases that inspects r.stdout or r.stderr (whichever run returns
parser messages on) for the exact "Unknown onboard option" text.

In `@test/update.test.ts`:
- Around line 20-23: The test "update command appears in help output" (and the
similar assertion around lines 44-52) uses broad substring checks; replace the
loose expect(output).toContain(...) checks with assertions that match the
specific help row for the update command by using an anchored, line-scoped
regular expression that ensures a single help line begins with the "update"
command and includes the expected flags (e.g., --check and --auto) and spacing;
update the assertions that consume execSync(`node "${CLI}" help`) to use this
scoped regex match so the test fails when the update row is malformed rather
than when the tokens appear anywhere in help output.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/update.ts`:
- Around line 506-519: The resolveUpdateLogFilePath function currently calls
resolveHomeDirectory(env) which bypasses the HOME safety checks used by the
credentials code; replace that call with the validated home resolver used by the
credentials module (the same function that enforces HOME safety) so update log
directory creation uses the guarded HOME value, and keep the existing
mkdirSync/error handling around the resulting baseDir; update the import at the
top to bring in the validated resolver and use it instead of
resolveHomeDirectory(env) inside resolveUpdateLogFilePath.
- Around line 479-487: The helper describeWorkerResult currently hides spawn
failures because it only checks status and signal; update it to surface the
SpawnSyncReturns.error when present (check the result.error property on the
SpawnSyncReturns<string>), and return a descriptive string incorporating
error.name, error.code and/or error.message (and optionally error.stack) so
detached-update logs show why npm/sudo failed to start; keep the existing
branches (status -> "exit X", signal -> "signal Y") and only fall back to the
error-derived message before returning "unknown exit".