fix: match terminal codes explicitly in safe-plugin-update poll

[Gmulti]

Summary

• Step 6 of safe-plugin-update.md exited the poll loop as soon as .code was any non-empty value. The /processes status enum in openapi-public.json includes pending, so a queued process surfaces a non-empty but non-terminal code — the loop could declare success while the update was still running.
• Replace the truthy check with a case match against the three terminal codes (success, failed, finished) and default missing .code to pending so the still-running signal is unambiguous.
• Document the canonical terminal codes in SKILL.md section 6 so future workflow authors do not re-introduce the bug.

skills/ regenerated via UMBRELLA_SKIP_COMPRESS=1 bash scripts/build.sh (mirrors what CI does — claude CLI is not on the runner so caveman is auto-skipped) so src/ and skills/ stay byte-identical.

Closes #4

Test plan

• verify-build CI passes (skills/ matches src/).
• Manually trigger a safe plugin update against a real project: confirm the loop sleeps while code is pending/missing and only exits on a terminal code.
• Loop timeout path (no terminal code within 2 min) still falls through to the "still queued" message.