fix(update-change): step 4 says apply the edit, step 5 says write only after confirming #1836

Same class of bug as #1828: a write gate stated in one part of the body, contradicted by an instruction earlier in the same body, with nothing saying which governs.

src/core/templates/workflows/update-change.ts:61 (skill) and :152 (command), step 4 "Read and reconcile":

• Apply the requested edit. Then check every other existing artifact against it…

:66-67 / :157-158, step 5 "Confirm and apply, one artifact at a time":

• Show each proposed revision and why. Write only after the user confirms.

:91 / :182, Guardrails:

• Confirm every edit with the user before writing.

"Apply" reads as a write verb in this very document — step 5 is titled "Confirm and apply", and step 4's own last bullet ("If the change is already coherent, say so and make no edits") only parses if step 4 is the editing stage. So /opsx:update "the design now uses X" either writes immediately or stops and shows the revision first, depending on which passage the agent weighs. This is the only write path in the workflow, so its confirmation guarantee is unenforceable if step 4 governs.

Fix is one word: Determine the requested edit or Draft the requested edit at :61 and :152. Step 5 already owns the writing.

Also: test/core/templates/ has no update-change.test.ts, so nothing pins this contract on either delivery surface.

Found by a cross-workflow sweep for the #1828 shape while hardening #1832.