release: r019 idempotent batch container updates

src/security.test.ts

@@ -22,6 +22,14 @@ describe("secure tool configuration", () => {
     expect(cfg.allToolsEnabled).toBe(true);
     expect(cfg.enabledTools).toEqual([]);
   });
+
+  test("an enabled legacy update also exposes the safer batch update", () => {
+    const cfg = parseConfig(
+      "MUA_API_KEY=test\nMUA_ENABLED_TOOLS=unraid_docker_update\n",
+    );
+    expect(cfg.enabledTools).toContain("unraid_docker_update");
+    expect(cfg.enabledTools).toContain("unraid_docker_update_verified_batch");
+  });
 });
 
 describe("secret handling", () => {
@@ -40,6 +48,7 @@ describe("risk classification", () => {
   test("classifies root shell and container changes as critical", () => {
     expect(getToolRisk("unraid_system_shell")).toBe("critical");
     expect(getToolRisk("unraid_docker_modify")).toBe("critical");
+    expect(getToolRisk("unraid_docker_update_verified_batch")).toBe("critical");
     expect(getToolRisk("unraid_docker_restart")).toBe("write");
     expect(getToolRisk("unraid_network_lan_probe")).toBe("active");
     expect(getToolRisk("unraid_docker_list")).toBe("read");