Development record

abcd update --help (internal/surface/cli/update.go) says build provenance is pinned to intentdriven/abcd's release.yml and to the tag's commit, leaving out that the signer must be release.yml on refs/heads/main, which commands/update.md, docs/how-to/install.md and internal/core/update/provenance.go require.