Confirmation modals for /update dependency-refresh flows in the TUI.
When deepagents-code itself is already on the latest release, /update can
still re-resolve its dependencies to the newest versions allowed by the pinned
ranges (e.g. a new langchain-openai). The already-current path dry-runs the
resolution first, then asks for explicit confirmation only when dependencies can
move. /update --deps skips that prompt, but asks before taking an available
app update ahead of the dependency refresh for the current app version.
