v2: core should own a batch update flow (serve wraps per-mod UpdateApplyResults today)

[dyoung522]

Candidate issue from the serve Unit 5 (#322) gate review: the web UI's per-item update batch (#74) is a serve-owned job that re-plans and applies per row, and its result document is a thin pinned wrapper of core.UpdateApplyResults — acceptable for v2.1.0, but the batch semantics (ordering, stop-on-error policy, one freshness window for the whole batch) properly belong in core as a PlanUpdateBatch/ApplyUpdateBatch pair that the CLI's update --all/-i selection could share. Post-v2.1.0.

[dyoung522]

Closed by the Unit 8 merge into webui (dec68e4, #334): core owns the batch update flow — Service.PlanUpdateBatch/ApplyUpdateBatch with one freshness window, documented ordering, per-item lock refusals and Ruling-16 cancellation — consumed by both lmm serve's updates kind and lmm update --all (which now applies under --json and emits UpdateBatchResult). Not yet released.