[cory-salad]

Summary

When you run container-groups update with a new image, the API accepts the change at once and then checks it before
any instance runs it. If the registry doesn't serve that image, for example a tag that doesn't exist or a private image
sent without its registry credentials, the platform drops the new version and the group keeps running the old one. The
CLI waited for the change to settle, but it only printed one warning: line on stderr, exited 0, and never showed the
platform's reason, so a failed update looked like a success. Now update treats a container change that didn't land
as an error: it exits 6 with the platform's reason, and when the image changed without credentials, the hint says a
private image needs them sent again.

Changes

• internal/cli/intentdiff.go, groups.go: after the settle, update fails when a container change didn't land.
  Either of two signals is enough: a container field the patch named (image, command, CPU, memory, GPU classes,
  storage, an environment variable) stayed exactly where it was, or the write left a new Version N: <reason>
  description for an N above the running version. Only a new report counts, because the API keeps the old one on the
  group through later writes. The error is exit 6, kind invalid_input, with empty stdout and a message such as
  the API did not apply the container change to my-app: Version 2: Manifest Not Found.
• When the patch changed the image without container.registry_authentication, the hint reuses create --from's
  credential advice. It is keyed on the failure, not on the registry, so it applies to Docker Hub too.
• internal/cli/containerrejection_test.go: unit and harness tests for both signals, the stale-description case and
  the hint.
• internal/livetest/provision_test.go: TestGroupLifecycle gains an update to a tag that doesn't exist.
• docs/guide.md, docs/commands.md, docs/notes.md, the validation table in AGENTS.md, and a ### Fixed
  CHANGELOG entry.

Contract change

container-groups update now exits 6 (kind invalid_input, stdout empty) in a case where it used to exit 0 and print
the settled group. No new exit code or error kind; the guide's exit-code and kind tables mention the new case.

Checklist

• just ci passes (formatting, lint, and the offline tests): run locally on Windows with Go 1.27.3, after merging
  main.
• docs/ (and the README, if install or getting started changed) and CHANGELOG.md (under Unreleased) reflect the
  change.
• Anything that touches an API call was exercised live, or this pull request says it was not: exercised live by
  hand on a busybox CPU group, both running and stopped, with a tag that doesn't exist. The private-image case
  wasn't reproduced live; its message comes from an earlier failure. There's no record yet of just test-live
  being run with the new TestGroupLifecycle step.

🤖 Generated with Claude Code