v3.32.0: the packaged-install updater + a repo CHANGELOG

Reinstalling the package was slow because setup rebuilds pysim's
prerequisites (pyscard compiles from source on Linux), while a clone
updates with a plain `git pull`.

- tools/update.py (+ update.sh / update.bat in the package, and the
  release workflow shipping them) updates a packaged install in place:
  it downloads the latest release package, extracts it (zip-slip guard,
  permission bits restored - zipfile drops them), replaces the app files
  over the app directory and re-installs the app into the existing
  .venv.  The .venv and simple_lastrun.log are not in the package, so
  pysim and its prerequisites survive: seconds, not a rebuild.
  --check / --version / --zip (offline) / --no-pip / --force; the same
  version is a no-op.
- CHANGELOG.md (Keep a Changelog, from the first packaged release;
  earlier history is the git log).  The release workflow now uses the
  version's CHANGELOG section as the release body
  (tools/changelog_section.py, falling back to generated notes).
- The READMEs document the update path and the `git clone --depth 1`
  option for the clone path; setup prints the update hint.
- Version strings + the PWA cache bumped together (simple-v458).

Verified: 1007 Python + 953 frontend; the release-package test covers
the new files; the updater was exercised end to end (a v3.31.2 install
with a real venv updated to the 3.32.0 package: files replaced, the
venv marker kept, pip metadata 3.32.0, exec bits kept, a second run a
no-op, --check correct).

README.md

@@ -30,11 +30,17 @@ The package is built from the tagged source — no git history, no development f
 Git is still required: `setup` installs **pysim** from its upstream repository
 (nothing from pysim or its dependencies is bundled).
 
+**Updates are fast:** `./update.sh` (or `update.bat`) downloads the latest release
+package, replaces the application files in place and re-installs the app into the
+existing `.venv` — pysim and its prerequisites are kept, so nothing is rebuilt.
+`./update.sh --check` reports the current and latest versions, `--version X.Y.Z`
+picks a specific release and `--zip file.zip` updates from a local package.
+
 **2. Clone the repository (for development, or changes not released yet).**
 
 ```sh
-git clone https://github.com/anttro/simple.git
-cd simple
+git clone https://github.com/anttro/simple.git   # or --depth 1: no history,
+cd simple                                        # `git pull` still updates it
 ./setup.sh     # or setup.bat on Windows
 ./start.sh     # or start.bat
 ```
@@ -748,6 +754,7 @@ The bundled Python server wraps [pySim](https://osmocom.org/projects/pysim/wiki)
 |--------|-------------|
 | `setup.sh` / `setup.bat` | Creates `.venv/`, installs pysim and the server. Run once after cloning or after unzipping the release package. |
 | `start.sh` / `start.bat` | Starts the server from the venv (serves the PWA + API on `:8080`). |
+| `update.sh` / `update.bat` | Updates a packaged install in place: fetches the latest release package, replaces the app files and re-installs the app into the existing `.venv` (pysim is kept). `--check`, `--version X.Y.Z`, `--zip FILE`, `--no-pip`, `--force`. |
 
 `start.sh` asks for the first PC/SC reader when `pcscd` is running; otherwise the server still auto-detects a PC/SC reader itself, and with none present pysim falls back to its serial default `/dev/ttyUSB0` (pass `-d <device>` for a serial/FTDI reader). `start.bat` always passes `-p 0` (PC/SC is built into Windows). Extra arguments are passed through to the server, e.g. `./start.sh --gsmtap` or `start.bat --gsmtap 10.0.0.5:4729`. If no reader is found the server still starts ("Reader: none") — initialize the card later via the **Equip** button.