Development record

The brief at .abcd/development/brief/04-surfaces/21-update.md:9-14 says update, with its check, is the only command that reaches the release origin, and at :92 that its transport redirects only onto the release origin's own hosts; it names no other network destination. update also reaches GitHub's attestations API and Sigstore's TUF repository (tuf-repo-cdn.sigstore.dev) to verify build provenance (commands/update.md:26-28).