fix(ai-cli): install current upstream Codex and Claude releases

- Pin official Codex 0.161.0 and Claude Code 2.1.292 binaries
- Preserve Codex helpers and Claude's NixOS compatibility wrapper
- Add an updater for stable upstream versions and checksums
- Document CLI updates independently of stable NixOS inputs

README.md

@@ -104,9 +104,28 @@ Studio remains on the ThinkPads as an existing IDE/workflow choice, but its
 bundled SDK is worth reviewing if moving fully to project-local tooling.
 
 Codex CLI (`codex`) and Claude Code (`claude`) are installed on every host.
-Run each command as your normal user and follow its sign-in flow. Update these
-Nix-managed packages through the flake and rebuild rather than their standalone
-installers. Authentication stays in your home directory, outside this repo.
+Run each command as your normal user and follow its sign-in flow.
+They use official upstream binaries, with versions and SHA-256 checksums pinned
+in `packages/ai-cli-versions.json`, independently of the stable NixOS release.
+`packages/ai-cli.nix` packages Codex and reuses Nixpkgs' Claude Code wrapper.
+Authentication stays in your home directory, outside this repo.
+
+To update both to the latest stable upstream releases, run from this repo:
+
+```sh
+nix shell nixpkgs#python3 -c python3 scripts/update-ai-cli.py
+git diff -- packages/ai-cli-versions.json
+nix build .#codex .#claude-code --no-link
+sudo nixos-rebuild switch --flake .#framework
+codex --version
+claude --version
+git add packages/ai-cli-versions.json
+git commit -m "chore(ai-cli): update upstream releases"
+```
+
+Use your own host name when rebuilding. The updater changes only the CLI pins;
+`nix flake update` updates NixOS inputs but does not update these pins.
+Updates remain explicit and reproducible; no upstream self-updaters are used.
 
 The official ChatGPT Linux desktop preview does not formally support NixOS.
 Our pinned `chatgpt` package supports macOS only, so it is not installed here.