feat: add specify update command for safe template/script sync

[lkeude96]

Description

• add a specify update command that fetches the latest Spec Kit templates and scripts
• only touch the allowlisted assets (.specify/templates, .specify/scripts, .specify/commands, top-level templates/, scripts/), leaving protected paths alone
• remove template files that were dropped upstream, normalize script permissions, and document the new workflow

Context

I’d been rerunning specify init to grab new Spec Kit changes to the templates and scripts, and it kept overwriting other components I already had in place. The new command keeps those preconfigured paths intact while still picking up the latest templates and scripts.

How it Works

• resolves the active assistant and script bundle (or accepts --ai/--script) before downloading the matching release asset
• stages the release in a temp workspace, compares it with local allowlisted files, and produces a change list (create/update/delete)
• skips protected directories like .specify/memory and .specify/history, so past specs and context remain untouched
• supports --dry-run for preview-only, --yes/-y for unattended runs, plus --github-token, --skip-tls, and --debug for advanced cases
• after applying updates, reapplies executable bits to any refreshed shell scripts

Example

# inside an existing Spec Kit project
specify update --dry-run   # preview what would change
specify update             # apply the curated diff with a confirmation prompt
specify update --yes       # non-interactive apply (e.g., CI workflow)

Screenshots

Update old version to new

No changes