Safe Auto-Update
Fetches the latest ruleset and applies it — safely:
python3 scripts/update.py
The update is data only. update.py downloads a release, verifies its
detached signature against a pinned public key, checks the content hash, and
then loads the rules as JSON. It never executes fetched content, has no
time-gated branch, and refuses the update if the signature or hash fails.