feat(update-seam): first-class update operation through the provider seam

Brainy's planner emits a single UpdateInMetadataIndexOperation /
UpdateVerbInGraphIndexOperation when the registered provider announces the
`update-op` capability (capabilities has 'update-op' AND the method exists —
both halves), and the legacy remove+add pair otherwise. A provider whose
capability set claims what the instance lacks is refused at registration
with a typed ProviderCapabilityMismatchError — never a silent fallback.

- MetadataIndexProvider.updateIndex(id, before, after, generation?) and
  GraphIndexProvider.updateVerb(id, before, after, generation) — optional,
  rollback symmetric by construction (update(a,b) undone by update(b,a)).
- Emission at update(), planTxUpdate() and updateRelation()'s graph leg.
- transact() gains op:'updateRelation' (TxUpdateRelationOperation), born
  batchable; updateRelation()'s record build is shared with the planner.
- Both paths live for one overlap release; the pair path retires with the
  provider-side compensation layer in the following cut.

Pinned in tests/integration/update-op-emission.test.ts (7 pins).

src/transaction/operations/index.ts

@@ -26,8 +26,19 @@ export {
   ReplaceInVectorIndexOperation,
   AddToMetadataIndexOperation,
   RemoveFromMetadataIndexOperation,
+  UpdateInMetadataIndexOperation,
   AddToGraphIndexOperation,
   RemoveFromGraphIndexOperation,
+  UpdateVerbInGraphIndexOperation,
   BatchAddToVectorIndexOperation,
   BatchAddToMetadataIndexOperation
 } from './IndexOperations.js'
+
+// Update-op capability check (the FIRST-CLASS UPDATE seam)
+export {
+  UPDATE_OP_CAPABILITY,
+  metadataUpdateOpProvider,
+  graphUpdateOpProvider,
+  assertUpdateCapabilityCoherent
+} from './updateCapability.js'
+export type { MetadataUpdateOpProvider, GraphUpdateOpProvider } from './updateCapability.js'