Allow project-specific validation in omm update

[johnnygreco]

Summary

Allow existing Python middleware projects to use their normal validation command during omm update, instead of the default pytest invocation:

omm update /path/to/middleware --openshell-version v0.0.116 --check-command 'make check'

• Run the command in the staged project and isolated Python environment after binding generation and dependency sync, before publishing generated artifacts.
• Parse quoted arguments without invoking a shell; keep the existing default validation and file-publication safeguards unchanged.
• Cover argument parsing, staged execution, and validation failure with regression tests, and document usage.

This is the manager-only work split out from the Pi admission example in #38. It contains no Pi harness changes, Egress Gate changes, generated protocol changes, or dependency additions. The example's pending generation-script update depends on this option and should follow this PR.

Validation

• uv run --frozen ruff format --check .
• uv run --frozen ruff check .
• uv run --frozen ty check
• uv run --frozen pytest — 91 passed; 95.83% coverage
• uv build
• python3 tests/test_render_dev_notes.py — 11 passed
• scripts/build-docs.sh — strict build and artifact checks passed

Known limitation

The README also records an existing starter-template incompatibility with OpenShell v0.0.116 (max_body_bytes). This PR does not change starter templates or claim to fix omm create for that release; it enables validation of updates to services already compatible with that contract.