fix: add missing detected harnesses during va update

[JacobStephens2]

Users upgrading to Muse support with va update receive the binary but still get unknown harness 'muse', because the old updater leaves Harness configuration untouched. This change makes update ask the newly installed binary to add missing profiles for detected agents, preserving existing profiles and configuration.

First-upgrade limitation: updaters shipped through v0.4.23 only replace the binary. After upgrading from one of those versions, users must run va update --sync-harnesses once (or repeat va update). Subsequent updates perform both steps in one command. The README, operator instructions, and migration notes document this transition.

• Share automatic command defaults between the installer and updater. Muse remains bare muse, so va muse --yolo passes through unchanged; Codex retains its native permission defaults.
• Reuse a Backend/Manifest pair only when all existing profiles agree. Otherwise create a verified empty starter and print a configuration reminder. No vault access or token capture occurs during update.
• Preserve existing files, including custom profiles and dangling symlinks. Retry root-owned machine configuration with sudo, without forwarding custom config paths across that hop.
• Keep check/dry-run non-mutating, use the target release’s catalog for future agents, and report partial failures with a setup-only retry command.

Validation: full cargo test, cargo fmt --check, cargo clippy --all-targets -- -D warnings, and bash -n install.sh. CLI regressions cover replacement followed by a secrets-injected Muse launch with --yolo, installer/update defaults across all seven profiles, mixed Manifests, file preservation, sudo-user discovery, manager-token scrubbing, and partial failures. Standards and Spec reviews: no remaining findings.

Follow-up to #105 and #103.