fix(update): rtk step — source cargo env + install-by-tag version guard

RC fix (soak day 1, #4). Two stacked defects: (1) update-all.sh never
sourced ~/.cargo/env (unlike install-plugins.sh), so on a profile that
lost the cargo PATH line the rtk step printed "Cargo not available" forever
— rtk never updated via make update (BLK-016 class). (2) once cargo was
found, the "latest" branch ran a bare `cargo install --git` (default-branch
HEAD) and would have recompiled Rust on EVERY update: upstream's HEAD
Cargo.toml (0.42.4) trails its newest stable tag (v0.43.0), so any
tag-vs-installed comparison never converges against a HEAD build.

Fix: source cargo env before concluding cargo is absent; resolve the newest
STABLE tag by name (sed anchored on refs/tags/v?N.N.N$ — dev-N.N.N-rc.*
pre-releases excluded; a naive version grep had picked dev-0.44.0-rc.308),
install BY TAG, and skip when installed == target. Proven live both ways:
run 1 compiled v0.43.0 (?tag=v0.43.0#5a7880d4), run 2 skipped
("already at latest tag (0.43.0)"). Pinned-version branch gets the same
skip-on-match guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS

update-all.sh

@@ -125,6 +125,13 @@ fi
 # ── 3. Update RTK (if pinned version available) ──
 echo ""
 echo "── Updating RTK..."
+# cargo lives in ~/.cargo/bin, which hand-managed profiles lose (BLK-016
+# class) — source cargo env, as install-plugins.sh does, before concluding
+# cargo is absent. Without this the step silently never updated rtk.
+if ! command -v cargo &>/dev/null && [ -f "$HOME/.cargo/env" ]; then
+  # shellcheck disable=SC1091
+  source "$HOME/.cargo/env"
+fi
 if command -v cargo &>/dev/null; then
   RTK_VERSION=""
   if [ -f "$REPO/plugins.lock.json" ] && command -v python3 &>/dev/null; then
@@ -136,23 +143,46 @@ print(d.get('rtk',{}).get('version',''))
 " 2>/dev/null || true)
   fi
 
+  # Version-jump guard: a cargo build takes minutes — only pay it when the
+  # target (pin, or the newest remote tag for "latest") differs from what is
+  # installed. Same pin-honored/skip-on-match shape as the semgrep step.
+  RTK_CUR=$(rtk --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
+  [ -z "$RTK_CUR" ] && RTK_CUR=$("$HOME/.cargo/bin/rtk" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
+
   if [ -n "$RTK_VERSION" ] && [ "$RTK_VERSION" != "latest" ]; then
-    info "Pinned version: $RTK_VERSION"
+    if [ "${RTK_VERSION#v}" = "$RTK_CUR" ]; then
+      ok "rtk already at pinned $RTK_CUR"
+    else
+      info "Pinned version: $RTK_VERSION (installed: ${RTK_CUR:-none})"
       info "Compiling from source — this may take a few minutes..."
       if cargo install --git https://github.com/rtk-ai/rtk --tag "$RTK_VERSION" --force; then
         ok "RTK updated to $RTK_VERSION"
       else
         warn "RTK update failed"
       fi
+    fi
   else
-    info "No pinned version — installing latest"
+    # "latest" = newest release TAG, resolved by name and installed BY TAG.
+    # (A bare `cargo install --git` builds the default-branch HEAD, whose
+    # Cargo.toml version can trail the newest tag — the guard would then
+    # never converge and recompile on every run.)
+    RTK_TIP_TAG=$(git ls-remote --tags https://github.com/rtk-ai/rtk 2>/dev/null \
+      | sed -n 's|.*refs/tags/\(v\{0,1\}[0-9][0-9.]*\)$|\1|p' | sort -V | tail -1 || true)
+    RTK_TIP="${RTK_TIP_TAG#v}"
+    if [ -n "$RTK_TIP" ] && [ "$RTK_TIP" = "$RTK_CUR" ]; then
+      ok "rtk already at latest tag ($RTK_CUR)"
+    else
+      info "No pin — latest tag: ${RTK_TIP_TAG:-unknown} (installed: ${RTK_CUR:-none})"
       info "Compiling from source — this may take a few minutes..."
-    if cargo install --git https://github.com/rtk-ai/rtk --force; then
+      if [ -n "$RTK_TIP_TAG" ] && cargo install --git https://github.com/rtk-ai/rtk --tag "$RTK_TIP_TAG" --force; then
-      ok "RTK updated (latest)"
+        ok "RTK updated to $RTK_TIP_TAG"
+      elif [ -z "$RTK_TIP_TAG" ] && cargo install --git https://github.com/rtk-ai/rtk --force; then
+        ok "RTK updated (latest HEAD — no tag resolvable)"
       else
         warn "RTK update failed"
       fi
     fi
+  fi
 else
   warn "Cargo not available — skipping RTK"
 fi