feat: add `basectl workspace update` to pull latest for all managed workspace repos

[codeforester]

Problem

basectl workspace pull clones repos that aren't present locally — it bootstraps a workspace. But once repos are present, keeping them current requires developers to git pull across each repo manually or script it themselves. There is no Base-managed command for the daily "sync workspace to latest" operation.

This is a gap in the workspace lifecycle: workspace pull bootstraps, but doesn't maintain currency.

Proposed solution

Add basectl workspace update [options] that:

1. Reads the workspace manifest to discover all managed projects.
2. For each managed repo (or a filtered subset) that is present on disk:
   • Runs git pull --rebase (or the project's configured update strategy).
   • Reports: updated (with commit range), up-to-date, or skipped (dirty working tree or detached HEAD).
3. Repos not present locally are reported as "not cloned — run workspace pull first" (not silently skipped).

Proposed interface

basectl workspace update                         # update all managed repos
basectl workspace update --repos proj1,proj2    # update specified repos only
basectl workspace update --dry-run              # show what would happen, no git operations
basectl workspace update --format json          # structured JSON output

Safety constraints

• Dirty working tree: skip the repo and report as "skipped (dirty)" — never rebase over local changes.
• Conflict during rebase: report as "conflict" and leave the repo in conflict state for the developer to resolve — continue updating remaining repos (unless --fail-fast).
• Never force-reset or discard local changes.

Acceptance criteria

• basectl workspace update is implemented as a new workspace subcommand.
• Updates managed repos via git pull --rebase (or equivalent).
• Dirty working tree: skipped with notice, no git operations run.
• Conflict: reported, repo left in conflict state, other repos continue.
• Not-cloned repos: reported as "not present — run workspace pull."
• --repos filter selects a subset by name.
• --dry-run prints what would happen without running any git commands.
• --format json emits structured per-repo result array.
• Command registered in docs/stability-tiers.md (Experimental initially).
• Help text and .ai-context/COMMANDS.md updated.
• Tests covering: up-to-date, updated (with commit range), dirty-skipped, not-cloned.