feat(system): add staged release updates

skills/moviepilot-api/SKILL.md

@@ -434,7 +434,7 @@ Streaming search sends `{"type":"heartbeat"}` every 15 seconds without business
 | POST | `/api/v1/workflow/fork` | Fork shared workflow. Body: WorkflowShare JSON |
 | GET | `/api/v1/workflow/shares` | List shared workflows. Params: `name`, `page`, `count` |
 
-### System (24 endpoints)
+### System (28 endpoints)
 
 | Method | Path | Description |
 |--------|------|-------------|
@@ -448,7 +448,11 @@ Streaming search sends `{"type":"heartbeat"}` every 15 seconds without business
 | GET | `/api/v1/system/global` | Non-sensitive settings. Params: `token` (required) |
 | GET | `/api/v1/system/global/user` | User-related settings |
 | GET | `/api/v1/system/restart` | Restart system |
-| POST | `/api/v1/system/upgrade` | Upgrade and restart system. Body: `"release"` or `"dev"` |
+| POST | `/api/v1/system/upgrade` | Retained Dev update and restart. Body: `"dev"` |
+| GET | `/api/v1/system/update/status` | Get Release check, download, or install state |
+| POST | `/api/v1/system/update/check` | Check the latest stable v3 GitHub Release |
+| POST | `/api/v1/system/update/download` | Start verified Release packages downloading in the background |
+| POST | `/api/v1/system/update/install` | Confirm restart and install the prepared Release packages |
 | GET | `/api/v1/system/runscheduler` | Run scheduled service. Params: `jobid` (required) |
 | GET | `/api/v1/system/runscheduler2` | Run scheduler (API_TOKEN, use `--token-param`). Params: `jobid` |
 | GET | `/api/v1/system/modulelist` | List loaded modules |

skills/moviepilot-update/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: moviepilot-update
-version: 3
-description: Use this skill when you need to check MoviePilot versions, restart MoviePilot, or trigger a MoviePilot upgrade. Prefer the built-in system APIs instead of docker commands or manual file replacement. If auto-update on restart is already enabled, just restart. If it is disabled, call the upgrade API so MoviePilot performs a one-shot upgrade and restart.
+version: 4
+description: Use this skill to check MoviePilot versions, inspect Release update state, download a Release update in the background, confirm installation, restart MoviePilot, or retain the existing Dev branch update flow. Prefer the built-in system APIs instead of container commands or manual file replacement.
 ---
 
 # MoviePilot Update
@@ -32,37 +32,50 @@ python scripts/mp-update.py restart
 
 This calls `GET /api/v1/system/restart`.
 
-### Upgrade and restart MoviePilot
+### Release update
 
-Release mode:
+Check for a stable Release and inspect current progress:
 
 ```bash
-python scripts/mp-update.py upgrade
+python scripts/mp-update.py check
+python scripts/mp-update.py status
 ```
 
-Dev mode:
+Start the background download. This does not restart MoviePilot:
+
+```bash
+python scripts/mp-update.py download
+```
+
+After `status` reports `state=ready`, installation requires a separate explicit confirmation:
+
+```bash
+python scripts/mp-update.py install
+```
+
+`install` writes the verified install intent and restarts MoviePilot. Do not call it until the user explicitly confirms the restart.
+
+### Dev update and restart
 
 ```bash
 python scripts/mp-update.py upgrade dev
 ```
 
-This calls `POST /api/v1/system/upgrade`.
-
-Behavior:
-
-- If `MOVIEPILOT_AUTO_UPDATE` is already enabled (`release` or `dev`), MoviePilot only triggers a restart and lets the normal startup flow perform the upgrade.
-- If `MOVIEPILOT_AUTO_UPDATE` is disabled, MoviePilot writes a one-shot upgrade flag, restarts itself, performs that single upgrade during startup, and then continues running without changing the persisted auto-update setting.
+Dev mode retains the existing `POST /api/v1/system/upgrade` path with body `"dev"`. It tracks the current v3 development branch during restart. Release mode is no longer accepted by that endpoint.
 
 ## Direct API Examples
 
 ```bash
 python ../moviepilot-api/scripts/mp-api.py GET /api/v1/system/restart
-python ../moviepilot-api/scripts/mp-api.py POST /api/v1/system/upgrade --json '"release"'
+python ../moviepilot-api/scripts/mp-api.py POST /api/v1/system/update/check
+python ../moviepilot-api/scripts/mp-api.py GET /api/v1/system/update/status
+python ../moviepilot-api/scripts/mp-api.py POST /api/v1/system/update/download
+python ../moviepilot-api/scripts/mp-api.py POST /api/v1/system/update/install
 python ../moviepilot-api/scripts/mp-api.py POST /api/v1/system/upgrade --json '"dev"'
 ```
 
 ## Notes
 
 - These operations require administrator authentication.
-- Restart or upgrade will interrupt the current agent session. Do not rely on post-restart follow-up steps in the same run.
+- Only restart, Release installation, and Dev upgrade interrupt the current agent session. Checking and downloading remain online.
 - Prefer the API flow above. Only fall back to manual container commands when the API is unavailable.

skills/moviepilot-update/scripts/mp-update.py

@@ -23,8 +23,12 @@ def print_usage() -> None:
     print(
         "Usage:\n"
         f"  python {Path(sys.argv[0]).name} versions\n"
+        f"  python {Path(sys.argv[0]).name} status\n"
+        f"  python {Path(sys.argv[0]).name} check\n"
+        f"  python {Path(sys.argv[0]).name} download\n"
+        f"  python {Path(sys.argv[0]).name} install\n"
         f"  python {Path(sys.argv[0]).name} restart\n"
-        f"  python {Path(sys.argv[0]).name} upgrade [release|dev]"
+        f"  python {Path(sys.argv[0]).name} upgrade dev"
     )
 
 
@@ -42,12 +46,20 @@ def main() -> int:
     if command == "restart":
         return run_api_call(["GET", "/api/v1/system/restart"])
 
+    update_commands = {
+        "status": ("GET", "/api/v1/system/update/status"),
+        "check": ("POST", "/api/v1/system/update/check"),
+        "download": ("POST", "/api/v1/system/update/download"),
+        "install": ("POST", "/api/v1/system/update/install"),
+    }
+    if command in update_commands:
+        method, path = update_commands[command]
+        return run_api_call([method, path])
+
     if command == "upgrade":
-        mode = (argv[1] if len(argv) > 1 else "release").strip().lower()
-        if mode == "true":
-            mode = "release"
-        if mode not in {"release", "dev"}:
-            print("Error: mode must be release or dev", file=sys.stderr)
+        mode = (argv[1] if len(argv) > 1 else "").strip().lower()
+        if mode != "dev":
+            print("Error: only Dev uses upgrade; use check/download/install for Release", file=sys.stderr)
             return 1
         return run_api_call([
             "POST",