Show pending node package updates (read-only)

U opens "Package updates": the pending apt updates of every online
node, with node, package, current and new version, origin and
priority. A node that fails is shown as "<node>: unavailable", and the
other nodes are still listed. A hint says the list is as of the
node's last apt update; this call does not refresh it.

The main frame's bottom border shows "· N package updates" after the
backup count, with a singular for 1. The count is fetched on mount,
after a context switch and whenever the updates screen loads, not on
every guest reload, since it costs one CLI call per node. It uses the
same generation guard as the guest list, so a count from the old
cluster is dropped after a switch.

Running apt update or upgrade stays out of scope; it is a write.

Read-only live check: "mainframe · 23 package updates", and 23 rows
in the screen.

Closes #13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/guest-tui-mvp.md

@@ -591,3 +591,41 @@ CLI facts (read-only probes):
   a read-only plain-text log widget `#tasklog` (no markup parsing), loaded in a worker;
   failure -> error notify. `escape` closes.
 - Main-screen footer shows `l Tasks`.
+
+---
+
+# Node package updates (issue #13)
+
+## Decision (user-approved)
+
+`U` on the main screen shows pending package updates per node; the frame's bottom
+border shows the count. Read-only: running `apt update`/`upgrade` stays out of scope.
+
+CLI facts (read-only probes):
+
+- `get nodes -o json` -> list of dicts with `node`, `status` (`online`/`offline`), ...
+- `get node packages <node> -o json` -> list of dicts with `Package`, `OldVersion`,
+  `Version`, `Title`, `Priority`, `Origin`, ... (23 on mainframe). The list is as fresh
+  as the node's last `apt update` (Proxmox runs it daily); the call does not refresh it.
+
+### `cli.py`
+
+- `nodes() -> list[str]` - names of online nodes, sorted.
+- `package_updates(node) -> list[dict]` - `get node packages <node> -o json`, sorted by
+  `Package`.
+
+### `app.py` (UI contract)
+
+- `UpdatesScreen(ModalScreen)` opened by `U`: frame `#updates_section` titled "Package
+  updates", `DataTable#updates`: Node, Package, Current (`OldVersion`), New
+  (`Version`), Origin, Priority; `Static#updates_note`: "No pending updates" when
+  empty, plus one line per node that failed ("<node>: unavailable: <summary>") and a
+  fixed hint that the list is as of the node's last apt update. Loaded in a thread
+  worker; `g` reloads; `escape` closes. A failing node does not hide the others.
+- The main frame's bottom border adds "· N package updates" when N > 0, after the
+  backup count. The count is fetched in a worker on mount, after a context switch, and
+  every time the UpdatesScreen loads - not on every guest reload (one CLI call per node).
+  It follows the same generation guard as the guest list (a count from the old cluster
+  is dropped after a switch) and is cleared when a switch starts. Failures leave the
+  count unknown (nothing shown), no error notify on mount.
+- Main footer shows `U Updates`.