feat: add safe cross-platform upstream updater (#98)

* feat: add safe upstream update scripts

* fix(updater): use portable PowerShell temp path

---------

Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com>

scripts/update-protected.txt

@@ -0,0 +1,21 @@
+# Paths preserved across `npm run update` (repo-relative).
+# Lines starting with # are ignored. Glob * and ** supported.
+# Optional overlay: scripts/update-protected.local.txt
+
+.env
+.env.*
+!.env.example
+.keys.local
+.keys.bounty.json
+bench/cybench/corpus-stage/
+bench/cybench/service-stage/
+bench/cybench/challenges/
+bench/xbow/stage/
+bench/xbow/challenges/
+bench/wild-hunt/
+bench/decomposition-results/
+bench/refusal-frontier/
+bench/nyu/
+docs/disclosures/
+reports/
+evidence/