Contributor PRs: write down the chores policy and add a /update command #464

Maintainers now handle the mechanical chores on contributor pull requests (merging main, resolving conflicts, changelog file names, lint fixes, re-running checks), while anything that changes behaviour or design stays with the contributor as a review. This needs:

1. The policy written down in CONTRIBUTING.md (what we may do on your branch, what we always do, what stays yours, and that the merge queue doesn't need an up-to-date branch), plus a line in docs/AGENT_WORKFLOW.md for agents.
2. A /update comment command on pull requests. The PR author or anyone with write access comments exactly /update; a bot merges main into the branch with GitHub's update-branch API (a merge, never a rebase) and replies in plain words. On conflicts it lists the files, adds a needs update label and says a maintainer will resolve them. The label comes off once the branch is up to date. The bot never checks out or runs the PR's code.

Open question to test for real: whether the workflow's built-in token may update a branch in a fork. If not, the command falls back to pointing the contributor at GitHub's own "Update branch" button and labelling the PR for maintainers, with no personal tokens or new secrets.