* docs(parity): audit upstream releases 0.59.0 through 0.60.4

Review six stable releases against Plasma HEAD: source-observed
credit-availability (creditsAvailable/balanceIsWorkspace) and structured
detail-row (id/progress/usageValue) fields stay unverified without
authenticated output; Cursor cost, provider descriptors, and generic
config actions re-verified unavailable on Linux 0.60.4 via
checksum-verified isolated probes. No behavior change; TODO baseline
advances to 0.60.4 with the 0.56.2 audit kept as contract baseline.

Verification: make check green; probes ran network-isolated with temp
home/cache, cleared env, installed CLI untouched.
Docs impact: new dated review indexed in docs/README; TODO entries
revised, none completed.

* docs(parity): scope balance flags to Codex workspace balances

Copilot seat-credit data travels in details rows with stable IDs; only
the Codex dashboard path writes creditsAvailable/balanceIsWorkspace.
Addresses CodeRabbit review on #269.

* ci: refresh apt indexes before installing test tooling

The pinned image snapshot 404s once the archive rolls superseded
packages (krb5 1.20.1-6ubuntu2.8), failing every check run before any
test executes. Refresh when reachable; a metadata outage still falls
back to the snapshot instead of failing the job.