update-keynctr.sh: fetch origin/master, ff-only pull (aborts on dirty
tracked tree), cargo + frontend rebuild, notify-send result. Login-shell
PATH is reconstructed for cargo/node. Idempotent: quiet no-op when
already current. Installed as 'Keynctr Update' desktop entry + right-click
'Update Keynctr' action on the main entry (entries live in
~/.local/share/applications, not tracked).
