PR3 (deferred): advisory 'Quickstart checkout is behind origin' update check #237

Part of quickstart#235. Deferred follow-up — do after PR2 (quickstart#236-ish sandbox reconcile) lands.

Advisory check in acq run: is the local Quickstart checkout behind the official Quickstart repo? Interactive only; cached ~24h; short network timeouts; fail-open on DNS/proxy/GitHub/auth/offline; default No; provide a review/commit URL; never git reset --hard, never switch branches, never non-ff. If the checkout is dirty/detached/packaged/symlinked-unusually, print the exact manual update command instead of acting. If a safe git pull --ff-only is accepted and acq files changed, exec with original args so the rest of the run uses the updated implementation + pinned ref. Never fetch/execute config from patterns main directly.

Deferred because it adds a distinct network + trust surface; the sandbox-reconcile value (PR2) lands first and stands alone.

Co-authored-by: OpenCode Agent [email protected]