fix: updating a Compose install takes a git pull, and the docs say what the script does (release review)

The summary and README said rerunning the script updates Codeman. It never
fetches, so that was a successful no-op. The summary, README, its zh-CN mirror
and the wiki now say git pull, then rerun, with the in-app route first.

Also corrects "printed once" (twice at a terminal, never off one), says a typed
answer beats a preset, adds the first-run setup, the 180 s wait, --no-wait and
the changeme refusal to Running-As-A-Service and Troubleshooting, and records in
architecture-invariants why docker/.env is generated FROM .env.example.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/docker-start-setup.test.ts

@@ -536,6 +536,8 @@ describe.skipIf(process.platform === 'win32')('Start-Codeman.sh first run, start
     expect(r.stdout).toMatch(/Sign in +admin, with the CODEMAN_PASSWORD from .*docker\/\.env/);
     expect(r.stdout).toMatch(/Logs +cd .* && docker compose logs -f codeman/);
     expect(r.stdout).toMatch(/Stop +cd .* && docker compose down/);
+    // Rerunning alone rebuilds the same checkout: nothing here fetches.
+    expect(r.stdout).toMatch(/Update +App Settings > Updates in the dashboard, or git pull and rerun this script/);
     const up = r.log.findIndex((l) => / up --build -d/.test(l));
     expect(up).toBeGreaterThan(-1);
     expect(r.log.findIndex((l) => l.startsWith('docker inspect'))).toBeGreaterThan(up);