chore: rename stale 'da' references to 'agnes' + CHANGELOG

Drive-by docstring/comment cleanup in cli_artifacts.py and update_check.py.
CHANGELOG entry for the auto-upgrade feature shipped in this branch.

CHANGELOG.md

@@ -10,6 +10,12 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
 
 ## [Unreleased]
 
+### Added
+
+- CLI auto-upgrade: `agnes self-upgrade` reinstalls the CLI from the server's currently-shipped wheel via `uv tool install --force`, falling back to `pip install --force-reinstall --no-deps` via `sys.executable` when uv is not on PATH. After install, the new binary is smoke-tested at the install-resolved path (`uv tool dir --bin` for uv, `<sys.executable parent>/agnes` for pip) — never via PATH lookup, to avoid stale-shadow false positives. Smoke failure triggers automatic rollback to the previously verified-good wheel (recorded in `~/.config/agnes/last_known_good.json`); rollback's exit code is captured and surfaced on stderr if it also fails. First-ever upgrade or unrecoverable rollback prints the canonical bootstrap recovery: `curl -fsSL <your-agnes-server>/cli/install.sh | bash`. The new command is wired into the SessionStart hook installed by `agnes init` as a chained shell entry (`agnes self-upgrade … || true; agnes pull … || true`) so an upgrade failure does not block the pull.
+- Server: `/api/*` responses now carry `X-Agnes-Latest-Version` and `X-Agnes-Min-Version` headers. CLIs older than `X-Agnes-Min-Version` exit with **code 2** and a remediation message instead of failing on a wire-protocol mismatch. Day-one floor is `0.0.0` (no enforcement) — bump `MIN_COMPAT_CLI_VERSION` in `app/version.py` in the same PR that ships a deliberate wire break.
+- CLI: `cli/update_check.py:check()` accepts a keyword-only `bypass_disabled=True` so explicit `agnes self-upgrade` invocations probe `/cli/latest` even when `AGNES_NO_UPDATE_CHECK=1` is set (which silences the implicit warning loop only).
+
 ## [0.42.0] — 2026-05-06
 
 ### Fixed
@@ -99,6 +105,8 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
   the fix logs and continues — the next extractor pass creates the
   file and the master view appears on the rebuild after that.
 
+## [0.39.0] — 2026-05-06
+
 ### Performance
 - **`/api/query` (and `agnes query --remote`) now rewrites user SQL referencing
   `query_mode='remote'` BigQuery rows into a single `bigquery_query()` call

app/api/cli_artifacts.py

@@ -43,7 +43,7 @@ def _find_wheel() -> Path | None:
 async def cli_latest():
     """Metadata for the currently-shipped CLI wheel.
 
-    Consumed by `da` CLI's auto-update check so it can warn when a newer
+    Consumed by `agnes` CLI's auto-update check so it can warn when a newer
     version is on the server. Public + cacheable — no secrets here.
     Returns `version=None` when the server has no wheel yet (dev image that
     didn't run `uv build`).

cli/update_check.py

@@ -1,7 +1,7 @@
 """Auto-check for a newer CLI version on the configured server.
 
 Runs in the root typer callback before subcommand dispatch. Failure is
-silent — we never block a working `da` command on a best-effort version
+silent — we never block a working `agnes` command on a best-effort version
 probe. Result is cached in `$AGNES_CONFIG_DIR/update_check.json` for 24h so
 we don't hammer the server on every invocation.
 
@@ -23,7 +23,7 @@ _CACHE_FILENAME = "update_check.json"
 _CACHE_TTL_SECONDS = 24 * 60 * 60  # 24h on a successful probe
 _NEGATIVE_CACHE_TTL_SECONDS = 5 * 60  # 5min on a failed probe, to avoid
 # re-probing 3s of silence (drop-packet networks: corporate firewall, VPN)
-# on every `da` invocation.
+# on every `agnes` invocation.
 _REQUEST_TIMEOUT_SECONDS = 3.0  # keep startup snappy