v0.2.1 — flag consistency + self-update via nestagents.io

[ungaro]

Small consistency pass before public release. All three changes are backward-compatible (old flags kept as visible aliases for one release cycle; plan to drop in v0.4.0).

1. --user → --address (alias --user)

Six redemption commands used --user; three others already used --address. Unified on --address everywhere, with --user kept as a visible alias. Affected: claim {pending,submit}, instant-redeem submit, update-redeem {pending,submit}, auto-claim {status,enable,disable}.

2. --vault-slug → --vault (alias --vault-slug) on history

Every other vault-targeting command uses --vault; history was the lone --vault-slug. Renamed, alias kept.

3. nest update now uses the nestagents.io version manifest

Replaces the GitHub Releases lookup (which 401s while the repo is private). The GitHub/self_update path is removed entirely.

• Probes https://nestagents.io/downloads/version.json (override with NEST_UPDATE_MANIFEST_URL).
• --check: compares manifest version to the running version → "Up to date" / "Update available".
• no flag: downloads the matching host-triple artifact, verifies sha256, extracts nest, and atomically replaces the running binary (stage-alongside + rename).
• Windows: prints a "re-download the zip" message and exits 0 (self-replacing a running .exe is out of scope for v0.2.x).
• Any network / checksum / missing-artifact failure prints the curl … install.sh fallback and exits non-zero.

Dropped self_update; added sha2, flate2, tar.

Tests

• Alias parse tests for all six --user renames + the history --vault-slug alias.
• updater: is_newer, host_triple, and fetch_manifest against a wiremock server.
• update: decide (current vs newer), verify_sha256 (match/case-insensitive/mismatch), and install_archive (builds a real .tar.gz, extracts + replaces a temp dest).
• Verified nest update --check end-to-end against a local server (both "current" and "newer" responses).
• cargo test (32), cargo clippy --all-targets -- -D warnings, cargo fmt -- --check all green.

Out of scope (per spec)

• Publishing version.json to nest-agents (separate repo/commit, owned by the user).
• README --address migration (inline doc comments updated; README left to the user).
• Windows self-update.

After tag + release I'll report the commit SHA and the four platform-tarball sha256 sums for version.json.