update-core: apply WordPress core updates through core's updater #351

New tool saddle/update-core: apply a WordPress core update that WordPress already offers, through core's automatic updater in the background runner.

• Admin tier, destructive, gated; the token binds the offered version.
• Minor and security releases.
• A major release only when the owner has turned on WordPress's own "automatic updates for all new versions" in Dashboard → Updates (Fahim, 2026-10-12). Otherwise refused, pointing there. The preview for a major lists active plugins not tested with it and says there is no automatic rollback.
• Refused: a development version, a recorded critical core update failure, PHP or MySQL below what the release needs, and every blocked_by() reason.

Acceptance: gate, bind and refusal tests on fake offers, a runner test that never replaces core, the hard-line test extended.