feat: add update-only Space deploy

[osolmaz]

Opened on behalf of Onur Solmaz (osolmaz). Work is in progress.

Summary

Redeploying an existing pool should not ask for all setup answers again.
This adds an update-only command that reads the existing Space settings and uploads the latest Space code.
It preserves the dataset token, signing secrets, session secrets, and import state.

What Changed

The first-time setup flow stays available for creating a pool.
Existing pools now have a shorter path for normal code deploys.

• Added npm run update, which runs the setup CLI in update mode.
• Added CLI parsing for update [owner/xtap-pool].
• Added config derivation from existing Space variables.
• Added an update deployment path that asserts the existing public Space and private dataset before uploading.
• Documented the update command in the README.
• Added unit tests for CLI parsing and update config defaults.

Testing

Local validation passes.
The live Hugging Face deploy itself was not run from this PR.

• npm run test --workspace setup
• npm run typecheck --workspace setup
• npm run check
• npm run build
• git diff --check
• npm run update -- not-a-repo rejects before any network call.

Risks

The update path intentionally fails if the existing Space or dataset has the wrong visibility.
That is safer than silently creating or updating the wrong pool.

• If a Space is missing DATASET_REPO, update mode falls back to <space-owner>/xtap-pool-data.
• If a Space is missing ALLOWED_USERS or POOL_ADMINS, update mode falls back to the active HF user for bootstrap access.

[osolmaz]

Final report:

• Added npm run update for update-only Space deploys.
• The command defaults to <active-hf-user>/xtap-pool, accepts an explicit Space repo, reads existing Space variables, and skips the dataset token/import prompts.
• Update mode now preserves generated signing/session secrets even if SECRETS_INITIALIZED is missing; it does not repair missing secrets silently.
• Local validation passed:
  • npm run test --workspace setup passed: 9 files, 32 tests.
  • npm run typecheck --workspace setup passed.
  • npm run check passed: format, lint, typecheck, 24 Vitest files / 155 tests, extension tests / 66 tests, native tests / 41 tests, coverage, and slophammer dry.
  • npm run build passed for explorer, space, and setup.
  • git diff --check passed.
  • npm run update -- not-a-repo rejects before any network call.
• codex review --base main is clean after the secret-preservation fix.
• GitHub CI check passed on head d405cdea5321144b2e111606b5a5f2cb1787e919.

Merging autonomously as requested.