[codex] Add dropzone update helper

README.md

@@ -306,6 +306,27 @@ It:
 - requires a clean worktree before publishing
 - uses `gh` to create the GitHub release that triggers `.github/workflows/release.yml`
 
+## Update PRs
+
+`update.sh` is the interactive helper for testing upstream app bumps on a throwaway branch and PR before they land on `main`.
+
+```bash
+./update.sh --dry-run
+./update.sh n8n
+./update.sh openwebui --yes
+./update.sh --all --yes
+```
+
+It:
+
+- checks the latest supported upstream pins for `n8n` and `openwebui`
+- updates the matching checked-in refs, versions, and image digests in the repo
+- creates a `test-update-<abbr>-<YYYY-MM-DD>` branch from the repo default branch
+- runs `./scripts/smoke-test.sh --syntax` and `./release.sh --dry-run`
+- commits the pin refresh, pushes the branch, and opens a draft PR to trigger CI
+
+Use `--no-push` to keep the branch local or `--no-pr` to stop after pushing.
+
 ## Verification
 
 ```bash

scripts/smoke-test.sh

@@ -108,7 +108,7 @@ curl_edge() {
 
 echo "=== Syntax checks ==="
 
-for file in "$PROJECT_DIR/deploy.sh" "$PROJECT_DIR/scripts/"*.sh; do
+for file in "$PROJECT_DIR/deploy.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/scripts/"*.sh; do
     if bash -n "$file" >/dev/null 2>&1; then
         pass "bash -n $(basename "$file")"
     else
@@ -126,7 +126,7 @@ for file in "$PROJECT_DIR/standalone/entrypoint.sh" "$PROJECT_DIR/standalone/con
 done
 
 if command -v shellcheck >/dev/null 2>&1; then
-    shellcheck_out="$(shellcheck -x "$PROJECT_DIR/deploy.sh" "$PROJECT_DIR/scripts/"*.sh 2>&1)" || true
+    shellcheck_out="$(shellcheck -x "$PROJECT_DIR/deploy.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/scripts/"*.sh 2>&1)" || true
     if [ -z "$shellcheck_out" ]; then
         pass "shellcheck shell scripts"
     else