Add user-triggered refresh from upstream tags

[picknik-johnny-5-bot]

[written by AI]

Motivation

Add an optional, quicker command for eligible upstream releases alongside the existing manual vendored-dependency workflow. Split from #894 to keep its validator and CI repairs separate.

Stacked on #894 (fix/887-review-findings). This diff contains only the refresher, its tests, and README instructions. Retarget to main after #894 merges.

Brief description

python3 bin/validate_workspace_dependencies.py --refresh-from-upstream all --dry-run
python3 bin/validate_workspace_dependencies.py --refresh-from-upstream feetech_ros2_driver --dry-run
python3 bin/validate_workspace_dependencies.py --refresh-from-upstream feetech_ros2_driver

• Accept all or a vendored dependency directory name, not a robot configuration.
• Select the highest eligible stable numeric tag on the configured branch that includes the existing pin. No prerelease, downgrade, or branch-HEAD fallback that could discard fork patches.
• Preserve local text patches through Git three-way merging and retain deliberate pruning. Fetch and verify actual LFS bytes for eligible asset updates.
• Stage and validate the proposed dependency before writing. Reject conflicts, dirty targets, ambiguous retention changes, and required license-metadata corrections with diagnostics.
• Leave committing and pushing to the user. No scheduled refresh, automatic PR, or upstream write.
• Preserve the original README and manual workflow verbatim; append an optional quick-refresh alternative with preview, refresh, validation, review, commit, and push instructions.

Remaining manual cases include ambiguous inventory changes, unsupported LFS transitions, divergent binary patches, and checkout line-ending normalization. all can apply independent successes while returning nonzero for failures. Writes are not crash-atomic across files. No real vendored dependency is upgraded by this PR.

The code cleanup reuses the ledger content comparison, deduplicates old inventory ancestors before filesystem checks, and shares fixture pin setup without removing assertions. The latest README-only correction restores every original byte from the stacked base and appends the quick-refresh instructions without replacing the manual workflow.

How it was tested

Published candidate: 8f11250a7d06a3a4302755bf6fe7534e1af9786f. Stacked base and merge-base: b277487ff665a01c96c56c8be5b978b1136ac9e7.

Fresh README-only validation at this candidate:

• Only README.md changed since reviewed code head c3d25348f05a5f25c5561f4f02688b6ff19fd548: 17 additions, zero deletions. No runtime or source changes.
• All 3,249 original README bytes are preserved verbatim as the candidate prefix. The README diff against the stacked base is additions-only: 39 added lines, zero removed lines.
• README pre-commit passed, including Markdown Link Check, codespell, and whitespace checks. Exact-range git diff --check passed.
• Independent exact-SHA code-reviewer and documentation-bot gates passed with no findings. Both independently checked byte preservation, the optional-alternative wording, and command documentation against unchanged implementation, and executed CLI help. These were independent Hermes CLI workers in isolated worktrees, not Claude invocations; both processes finished.

Earlier code validation, not rerun or relabeled as fresh README-candidate execution:

• At c3d25348f05a5f25c5561f4f02688b6ff19fd548: full bin/tests passed all 183 tests, including 51 refresher cases using disposable Git/LFS repositories. Offline validation passed for 9 vendored sources and 2 optional ML submodules.
• At that same code SHA: writer changed-file pre-commit and diff checks passed; independent code, documentation, licensing/privacy, platform, security, and test-runner gates passed. The independent test-runner's separate full pre-commit attempt was approval-blocked; its check-only cached lint passed, without certification against release pins. Sonar scope inspection found no configured analysis; no measured Sonar success is claimed.
• Network evidence remains from 8edfeb6c4c6a9c975c3232f67e4554ac3e4eced1: a Feetech dry-run using GitHub App authentication selected tag 0.2.2, already current. No real snapshot writes; not rerun for this documentation-only correction.

Remote CI is separate. The stacked base name fix/887-review-findings is known to produce an invalid integration Docker tag; that unrelated CI issue is not repaired here, and CI is not claimed green.

Release notes

Enhancement: Added a user-triggered command to refresh vendored workspace dependencies from eligible upstream release tags, with a dry-run preview.

Claude agent checks

These rows describe the fresh README-only delta at 8f11250a7d06a3a4302755bf6fe7534e1af9786f; earlier code-domain evidence is bound to its original SHA above.

• code-reviewer: exact-SHA documentation correction; no findings.
• documentation-bot: explicitly requested exact-SHA documentation gate; no findings.
• SKIPPED platform-architect-bot: README prose only; no backend, ROS, build, CI, or architecture code change.
• SKIPPED frontend-noah-bot: no frontend change.
• SKIPPED security-auditor: no security-sensitive implementation or configuration change.
• SKIPPED roboticist-bot: no robotics runtime change.
• SKIPPED licensing-privacy-bot: no third-party source, attribution, or runtime data-flow change.
• SKIPPED compatibility-bot: no public API or frontend/backend contract change.
• SKIPPED sonar-bot: no analyzed source or analysis-configuration change.
• SKIPPED test-runner: recorded last, after both independent reviewers finished; this delta contains no buildable or testable code. Fresh README checks and earlier code-test evidence are listed separately above.

Unattended or scheduled synchronization remains outside this PR and needs a separately scoped issue.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ This PR modifies 1 file(s) that also exist in PickNikRobotics/moveit_pro_empty_ws.

Consider whether the change should land upstream in moveit_pro_empty_ws first so downstream forks pick it up on the next sync.

Overlapping files

• README.md

[github-actions]

MoveIt Pro Example WS - Objectives Integration Test Report

• lab_sim
  • ❌ jazzy: no report produced — see run logs
• hangar_sim
  • ❌ jazzy: no report produced — see run logs

[github-actions]

MoveIt Pro Example WS - Objectives Integration Test Report

• lab_sim
  • ❌ jazzy: no report produced — see run logs
• hangar_sim
  • ❌ jazzy: no report produced — see run logs

[github-actions]

MoveIt Pro Example WS - Objectives Integration Test Report

• lab_sim
  • ❌ jazzy: no report produced — see run logs
• hangar_sim
  • ❌ jazzy: no report produced — see run logs