fix(cli): move upgrade helpers into the existing CLI package

[loopx-agent]

The required kernel static check rejects current main because loopx/*.py grew from its pinned 145 files to 147 after the upgrade adapters were added. This blocks the invariant gate that precedes full Python qualification. Both new helpers have one production consumer, cli_commands/support_control_update.py; move them into that existing CLI package.

UpdateProgress moves byte for byte. The upgrade adapter changes only three relative-import levels; the caller and existing regression tests point to the new internal paths. No root compatibility wrapper is retained: these are undocumented implementation modules with no exported or persisted import contract, and the caller inventory found no other production consumer. Public update/upgrade commands, output, installation ownership, prompt recovery and native App verification stay unchanged. The budget fixture and all original test assertions are unchanged.

This is a separate main-based repair for the required-CI hold observed on #6828, rather than mixing updater placement into that performance proposal.

Natural hosted validation

The required kernel job passed on the unchanged author head 0f3964dd330194af4ddde20cc79bc449c00b044f. Its actual checkout was synthetic merge e0c051b6b05ab1bdc4a4c439394f809308e19e3b (base 3203b5584); the complete Git tree is identical to the author tree. On Linux with Python 3.11.17 / Node 24.21, the original kernel command passed all 7 tests. The following File-authority suite passed 409 tests with no skips, and Ruff, mypy (17 files), and the CLI-output budget check all passed.

This qualifies the repaired prerequisite on the real hosted path. The earlier #6828 run stays failed; this result does not qualify the full six Python shards, coverage/final gate, sustained costs, installed behavior or adoption into main.

Evidence

The exact original two-file kernel command was run from immutable source archives:

Source	Root modules	Result
#6828 author 9a1b7f8a5	145	7 passed
CI base 3203b5584	147	1 failed, 6 passed
Observed CI merge d1f74e9bc	147	1 failed, 6 passed
This fix 0f3964dd330194af4ddde20cc79bc449c00b044f	145	7 passed

The original required hosted failure remains failed. This repair does not raise its budget or waive it through baseline attribution.

• Before the move: all four affected update modules passed, 82 tests and 2 Windows-only skips. After the move: 164 passed and the same 2 skips across ten complete update, installation, doctor, prompt and kernel modules.
• Both full import-boundary architecture modules: 29 passed.
• Documented CI Ruff roots, the touched CLI modules and configured mypy project passed.
• Built both normal wheels: the new wheel has 145 root modules, the moved helpers, and no old root entries. Ten shipped CLI base/head comparisons matched complete JSON, exits and stderr, normalizing only the two installation-location fields. These exercise real package-manager and native App discovery, input/source refusals and an explicit successful plan after refusal.
• Both wheels also passed the existing CLI-handler regression using a real isolated corrupt SQLite discovery source followed by repair and retry, preserving failure/success exits and text. Installer results and the absent-App plan remain explicit test substitutes; no actual installation, App restart or active Goal mutation was performed.
• The first private comparison oracle incorrectly assumed invalid bare-upgrade input would carry read-only intent. That harness assumption was corrected from the command contract; completed observations were retained and missing child exits were measured. Product code and public assertions were not changed for it.
• Exact-scope change-quality verified with no blockers or warnings: 79eb639d9b3c4e4613f1f92e26e6a7eab3a2c8f47ec71e47082feb1825afc70d. No quality safe-fix pass was needed. Signed commit, public-boundary scan, whitespace and bilingual checks passed.

Standard goal-aware premerge passed at the unchanged head: four direct checks, Python compilation and eight selected canaries, including installation, packaged Codex CLI, updater, maintainability, semantic vocabulary and CLI-output checks. No failures or manual holds. Merge authority remains separate.

The bounded refactor places the helpers with their actual caller; it adds no capability, provider, state or new execution authority. No visual surface changes. Rollback is one commit revert. Independent exact-head review and the remaining natural hosted CI are pending; full six-shard/coverage/final/CI24 and installed-upgrade acceptance are not claimed.