jalth upgrade now updates the local CLI from the release manifest and can chain the Worker redeploy from the freshly installed binary on admin and legacy enrolled devices. The command blocks unsafe in-place upgrades below minUpgradeableFrom with reinstall guidance, known non-admin devices get an “Ask an admin…” warning only when the deployed Worker is behind, and --cli-only skips the Worker phase when an admin only wants the local binary update. (#325)