…ps (#446)

## Summary

Two small changes in
[crates/aube/src/commands/update.rs](crates/aube/src/commands/update.rs)
that finish the `pnpm/test/update.ts` cluster everywhere except the
documented prerelease-preservation and shared-lockfile divergences.
Brings the file to **15/22 ports** (was 13/22).

## Changes

### 1. `<pkg>@<spec>` arg syntax

pnpm phrases the manifest-rewrite-past-range case as `pnpm update
foo@latest`; aube was rejecting that with *package foo@latest is not a
dependency* because it looked up the literal arg in the deps map. Now
`<name>@<spec>` is split (scope-aware via a `split_pkg_arg` helper), the
bare `name` drives the dep lookup, and `@latest` (the only spec form
pnpm tests rely on) acts as a per-key `--latest` — the manifest rewrite
triggers only for that one entry instead of every direct dep.

This drops the translation note from the misc.ts:14 port — the new test
in this PR uses the original `update <pkg>@latest` syntax verbatim
instead of rewriting to `update --latest <pkg>`.

### 2. `aube update <indirect-pkg>` no longer errors

Previously the args loop hard-failed on any name that wasn't in
`package.json`'s deps map. Indirect deps now flow through:

- Validated against the lockfile graph (rejected if not in any
direct/transitive snapshot entry).
- Filtered out of the locked snapshot so the resolver re-resolves.
- Their parents' locked dep edges get rewritten to `latest` when the
user passed `<indirect>@latest`.
- Manifest is left alone (the indirect has no entry to rewrite).
- The direct dep that pulls in the indirect stays at its locked version
— only the named arg bumps.

The parent-edge rewrite is the non-obvious bit. The resolver's
lockfile-reuse path
([aube_resolver::resolve.rs:1164](crates/aube-resolver/src/resolve.rs#L1164))
iterates each parent's locked `dependencies` map and enqueues transitive
tasks using the locked **version** as the range. Just dropping the
indirect from the `packages` map isn't enough — the parent's pinned edge
(`pkg-with-1-dep@100.0.0`'s `dependencies: { dep-of: 100.0.0 }`) still
re-resolves to the same version. Forwarding `latest` on the edge makes
the transitive task a dist-tag spec, so the resolver fetches the
packument and picks the new latest.

## Ports

| pnpm test (line) | aube `@test` |
|---|---|
| `update <dep>` (14) | `aube update <pkg>@latest: parses arg syntax,
rewrites manifest past range` |
| `update indirect dependency should not update package.json` (690) |
`aube update <indirect-pkg>@latest: refreshes a transitive dep, leaves
manifest alone` |

The earlier `update --latest <pkg>` translation of misc.ts:14 stays as
its own test — keeps coverage of both invocation forms.

## Remaining gaps in update.ts

After this PR, 7 of 22 tests stay unported, all because of distinct
divergences (each tracked in
[PNPM_TEST_IMPORT.md](test/PNPM_TEST_IMPORT.md)):

- 51, 95: `aube update` (no `--latest`) doesn't rewrite the manifest
spec when the existing range allows a newer version (pnpm does).
- 599: `aube update --depth N` is parsed-but-no-op.
- 615, 728, 807: aube's `update --latest` downgrades a manifest pin past
a registry's older `latest` dist-tag (pnpm preserves the pin when it's
numerically newer).
- 249, 302: subsumed by 369/543 — aube's `update -r` always writes
per-project lockfiles regardless of `sharedWorkspaceLockfile`.

## Test plan

- [x] `AUBE_TEST_REGISTRY=http://localhost:4873 ./test/bats/bin/bats
test/pnpm_update.bats` — 16/16 pass.
- [x] `AUBE_TEST_REGISTRY=http://localhost:4873 ./test/bats/bin/bats
test/update.bats test/add.bats test/install.bats` — 96/96 pass (no
regression to the existing aube-native test surface).
- [x] `cargo fmt --check`
- [x] `cargo clippy --all-targets -- -D warnings`
- [x] `cargo test --workspace`
- [x] `mise run render` — no docs/usage drift (the `--save-exact` flag
landed in [#438](#438)).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes `aube update` dependency selection and lockfile
filtering/rewriting behavior, including transitive edge rewrites, which
could affect resolution results across workspaces. Scope is contained to
the update command and covered by new bats regression tests.
> 
> **Overview**
> `aube update` now parses positional args of the form `<pkg>@<spec>`
(scope-aware) and treats `@latest` as a per-package equivalent of
`--latest`, while hard-erroring on any other spec to avoid silently
ignoring user intent.
> 
> The update flow now accepts *indirect (transitive) deps* named on the
CLI: it validates them against the lockfile graph (with a workspace-root
lockfile fallback), drops their snapshots from the reused lockfile, and
for `<indirect>@latest` rewrites parent locked dependency edges to
`latest` so the resolver actually re-resolves the transitive version;
`package.json` is left unchanged for indirect updates.
> 
> Recursive `update -r` was adjusted to forward indirect args into
per-project updates by consulting each project’s lockfile (with
shared-lockfile fallback) and to avoid misclassifying flag-excluded
direct deps (e.g. `--prod <devDep>`) as indirect. New bats tests cover
the new arg syntax, indirect updates, spec rejection, and the `--prod`
regression.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7f95613. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>