fix(update): never self-update a frozen binary; point at its own channel

[padak]

kbagent ships both as a Python distribution and as a self-contained
PyInstaller binary delivered by Chocolatey, WinGet, Homebrew, apt, dnf or a
signed zip. Nothing in the code detected the difference: grep -rn "sys.frozen\|_MEIPASS" src/ returned nothing.

That matters because the release workflow freezes with pyinstaller --collect-all keboola_agent_cli, and PyInstaller's collect_all() is a
superset of --copy-metadata. The whole .dist-info is bundled, so
importlib.metadata resolves a real version inside the binary and the
0.0.0-dev fallback never fires. Both update paths therefore planned
uv tool install --force --reinstall "keboola-cli[server] @ ...", which
cannot upgrade a package-manager-owned binary -- it installs a SECOND,
unrelated kbagent into the uv tool directory, which usually precedes the
package manager's directory on PATH. The user silently starts running a
different install than the one choco/brew/apt tracks while the real binary
stays stale; with no Python on the machine it just fails on every startup.

The startup hook was only ever suppressed for frozen builds by accident: CI
freezes from an editable install, so the bundled direct_url.json carries
"editable": true and _is_dev_install() happened to return True. Freezing from
a non-editable install flips that and the reinstall fires. Both states were
reproduced against real PyInstaller binaries; kbagent update was broken in
both, since it never consulted _is_dev_install() at all.

New frozen_dist module detects sys.frozen / sys._MEIPASS and maps the running
binary's own path to the channel that placed it. The self-update stage becomes
a notification carrying that channel's real command; an unattributable path
degrades to ARCHIVE and the release page rather than a wrong-but-plausible
guess. The guard sits ahead of the issue #528 should_defer() branch, so a
frozen binary is never scheduled for the deferred Windows install either.

• startup hook: notification throttled to once per version-cache TTL (it
  cannot resolve itself by re-exec'ing, so it would otherwise print on every
  command), and planning is short-circuited so the wheel-URL HEAD probe is not
  spent on a command we refuse to run.
• kbagent update: refuses and names the channel, and no longer reports that
  deliberate refusal as a failed update.
• kbagent version: advertises the channel command in place of
  "(run: kbagent update)", plus an additive install_channel key in --json
  (absent for Python installs, so their JSON shape is byte-identical).
• keboola-mcp-server still auto-updates on frozen builds by design: it is a
  separate Python distribution the binary only spawns as a subprocess, and a
  pure-binary user with no Python is unaffected because install-method
  detection returns "none".

Verified end-to-end against a real frozen binary placed in a Homebrew Cellar
path: the hook prints "brew upgrade keboola-cli2" and the uv tool environment
is left untouched. uv / pip installs behave exactly as before.

---

[devin-ai-integration]

Devin Review found 6 potential issues.

[padak]

All six Devin findings are addressed in 438c194 and dc4636d (the review above predates both).

#	Finding	Resolution
1	Reminder never appears on shipped binaries	The important one. _is_dev_install() now short-circuits on is_frozen_build(). My original end-to-end verification built from a non-editable install, so it never reproduced what CI ships. Re-verified against a binary frozen from an editable uv run sync — the exact CI configuration — and the banner now prints. Test exercises the real _should_skip_all() chain rather than stubbing it, since stubbing it is what hid this.
2	/usr/local/bin misattributed to apt/dnf	Dropped from NATIVE_SYSTEM_BIN_PREFIXES; nfpm only ever writes /usr/bin. Test parametrized over darwin and linux — the Linux case was the silent one, since apt-get exists on essentially every such host.
3	-> vNone available when offline	Summary now says "latest version unknown" when the release lookup fails. Regression test added.
4	keboola-expert.md still says "run kbagent update"	Added a version-gate note and a terse §3 gotcha. Prompt is 59632 B of the 62000 B budget.
5	Wall-of-text release note	Split into four bullets, one logical change each, per the changelog.py authoring contract.
6	upgrade_command holds prose for archive/system	It is now runnable-or-empty; the sentence moved to a new additive upgrade_hint key. The gotchas entry documents the contract and tells consumers to check for empty before shelling out.

Also swept the remaining convention #17 surfaces that a behaviour change in kbagent update touches but nothing gates: commands-reference.md, context.py (AGENT_CONTEXT) and the CLAUDE.md command list.