`gh aw update` leaves shared package dependencies stale

[mnkiefer]

gh aw update does not refresh shared dependencies owned by an aw.yml package. Currently, it updates source-tracked package entry points but does not refresh their installed shared dependency closure. This can leave workflows compiled against stale shared files even though the command reports that all workflows were updated to the latest source commit.

The affected package is githubnext/central-agentic-ops. Its aw.yml manifests define workflow entry points that import shared components such as:

• .github/workflows/shared/control.md
• .github/workflows/shared/control-precompute.md

These shared files were installed as dependencies of the package and should remain owned and updated through the package manifest. They should not require independent source: fields.

Actual behavior

The command reports that all five workflows were updated and compiled successfully. However, .github/workflows/shared/control-precompute.md remains unchanged, even though that file changed in the source commit. Compiled lockfiles can therefore continue embedding the stale shared implementation. Targeting the shared directory directly confirms that the updater skips these package dependencies because they do not have individual source: fields:

Skipping control-precompute: no source field
Skipping control: no source field
no workflows found with source field

Expected behavior

Updating a workflow installed from an aw.yml package should refresh the package entry points and their complete installed dependency closure at the selected source revision. This includes shared files reached through imports: and other package-owned resources.