Show pending node package updates (read-only)

U opens "Package updates": the pending apt updates of every online
node, with node, package, current and new version, origin and
priority. A node that fails is shown as "<node>: unavailable", and the
other nodes are still listed. A hint says the list is as of the
node's last apt update; this call does not refresh it.

The main frame's bottom border shows "· N package updates" after the
backup count, with a singular for 1. The count is fetched on mount,
after a context switch and whenever the updates screen loads, not on
every guest reload, since it costs one CLI call per node. It uses the
same generation guard as the guest list, so a count from the old
cluster is dropped after a switch.

Running apt update or upgrade stays out of scope; it is a write.

Read-only live check: "mainframe · 23 package updates", and 23 rows
in the screen.

Closes #13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_cli.py

@@ -1340,3 +1340,38 @@ def test_task_log_rejects_non_upid_without_calling_subprocess(
     with pytest.raises(ValueError):
         cli.task_log(bad)
     assert fake.calls == []
+
+
+# --- #13: nodes / package_updates (spec: "Node package updates (issue #13)") ---------------
+
+
+def test_nodes_argv_only_online_sorted(fake):
+    fake.result = (json.dumps([{"node": "zeta", "status": "online"},
+                               {"node": "down", "status": "offline"},
+                               {"node": "alpha", "status": "online"}]), "", 0)  # fmt: skip
+    assert cli.nodes() == ["alpha", "zeta"]
+    assert fake.argv == ["cv4pve-cli", "get", "nodes", "-o", "json"]
+
+
+def test_package_updates_argv_and_sorted_by_package(fake):
+    fake.result = (json.dumps([{"Package": "zsh", "Version": "2"},
+                               {"Package": "bash", "Version": "1"},
+                               {"Package": "curl", "Version": "3"}]), "", 0)  # fmt: skip
+    got = cli.package_updates("mainframe")
+    assert fake.argv == [
+        "cv4pve-cli",
+        "get",
+        "node",
+        "packages",
+        "mainframe",
+        "-o",
+        "json",
+    ]
+    assert [p["Package"] for p in got] == ["bash", "curl", "zsh"]
+    assert got[0] == {"Package": "bash", "Version": "1"}
+
+
+def test_package_updates_failure_raises_clierror(monkeypatch):
+    FakeRun(monkeypatch, "Error: node unreachable\n", returncode=1)
+    with pytest.raises(cli.CliError):
+        cli.package_updates("mainframe")