feat: phase 2 — audit config + update --rollback (closes #63 #64)

Axe 8 (sécurité) :
- am audit : checksums SHA-256 des configs (embarquée, utilisateur,
  locale) stockés dans state.json, croisement avec events.jsonl pour
  dater les changements, détection des modifications manuelles hors de
  am (statut MANUAL), rapport lisible + --json stable (contrat)
- backup automatique avant chaque am update (agent ou --all) : état +
  config utilisateur + répertoires d'installation + shims dans
  <state>/backups/<ts>/ avec manifest.json
- am update --rollback [point] : restaure le dernier backup (ou un id
  précis, préfixe accepté), arrête les agents concernés d'abord,
  événement EventKind::Rollback journalisé
- am update --rollback list : liste les points de restauration
- rétention settings.backups_keep (défaut 5) appliquée après chaque backup
- événements EventKind::Backup / EventKind::Rollback pour l'audit

REPL : commande audit + update --rollback (parse, complétion), help specs,
tip cheat sheet, man pages régénérées (50 pages). Version 0.4.6,
ROADMAP cases cochées, 272 tests verts.

src/help.rs

@@ -421,6 +421,42 @@ pub static HELP_SPECS: &[HelpSpec] = &[
             HelpExample { desc: "Machine-readable output.", code: "suggest frontend framework --json" },
         ],
     },
+    HelpSpec {
+        name: "audit",
+        category: "Commands",
+        usage: "audit {flags}",
+        about: "Who changed what, when: config checksums vs the event journal, manual edits flagged.",
+        search_terms: &["security", "trace", "checksum", "who changed", "history config"],
+        flags: &[
+            HelpFlag { short: "", long: "--json", value: "", desc: "Stable machine-readable report" },
+        ],
+        subcommands: &[],
+        parameters: &[],
+        io: None,
+        examples: &[
+            HelpExample { desc: "Run the config audit.", code: "audit" },
+            HelpExample { desc: "Machine-readable report.", code: "audit --json" },
+        ],
+    },
+    HelpSpec {
+        name: "update",
+        category: "Commands",
+        usage: "update {flags} <agent|--all>",
+        about: "Update installed agents; every update is backed up first and can be undone.",
+        search_terms: &["upgrade", "rollback", "restore", "backup"],
+        flags: &[
+            HelpFlag { short: "", long: "--all", value: "", desc: "Update every managed agent (one backup for the batch)" },
+            HelpFlag { short: "", long: "--rollback", value: "[POINT]", desc: "Restore a pre-update backup ('list' shows them, default: latest)" },
+        ],
+        subcommands: &[],
+        parameters: &[],
+        io: None,
+        examples: &[
+            HelpExample { desc: "Update one agent (backup taken first).", code: "update claude-code" },
+            HelpExample { desc: "List the available backups.", code: "update --rollback list" },
+            HelpExample { desc: "Undo the last update.", code: "update --rollback" },
+        ],
+    },
     HelpSpec {
         name: "alias",
         category: "Commands",
@@ -574,25 +610,6 @@ pub static HELP_SPECS: &[HelpSpec] = &[
             HelpExample { desc: "Remove everything, including logs and the config entry.", code: "uninstall claude-code --purge" },
         ],
     },
-    HelpSpec {
-        name: "update",
-        category: "Commands",
-        usage: "update {flags} [agent]",
-        about: "Update an installed agent to the latest available version.",
-        search_terms: &["upgrade"],
-        flags: &[
-            HelpFlag { short: "", long: "--all", value: "", desc: "Update every installed managed agent" },
-        ],
-        subcommands: &[],
-        parameters: &[
-            HelpParam { name: "agent", typ: "string", desc: "Agent name or alias (required unless --all)" },
-        ],
-        io: None,
-        examples: &[
-            HelpExample { desc: "Update one agent.", code: "update claude-code" },
-            HelpExample { desc: "Update every managed agent.", code: "update --all" },
-        ],
-    },
     HelpSpec {
         name: "start",
         category: "Commands",