Apply an available upgrade to a workload

Apply a registry-sourced upgrade to a single workload. This re-resolves and verifies the candidate image, pulls it, and only then recreates the workload with the new image, preserving the existing configuration. If the workload is already up to date or is not registry-sourced, the current check result is returned unchanged (no-op). Secret values are never accepted or returned.