Merge remote-tracking branch 'upstream/release/2.5' into fix/autowire-run-env

# Conflicts:
#	CHANGELOG.md

docs/install.md

@@ -2437,6 +2437,8 @@ the regular Docker path.
 
 ## Keeping ai-memory up to date
 
+### Docker wrapper
+
 The wrapper checks Docker Hub at most once every 24 hours and prints a
 one-line warning when a newer image is available. Upgrade with:
 
@@ -2467,6 +2469,41 @@ self-upgrades to a fork or tagged release, set `AI_MEMORY_WRAPPER_URL=<url>`;
 the wrapper requires `<url>.sha256` unless
 `AI_MEMORY_WRAPPER_SHA256_URL=<checksum-url>` is also set.
 
+### Native release binary (Linux / macOS / Windows x86_64)
+
+When `PATH` points at a GitHub-release `ai-memory` binary under a writable
+user prefix (for example `~/.local/bin`, or `%LOCALAPPDATA%\ai-memory` on
+Windows), the same command upgrades the binary itself:
+
+```bash
+ai-memory upgrade
+# optional: pin a tag, or force a re-download of the current tag
+ai-memory upgrade --version v2.3.2
+ai-memory upgrade --force
+```
+
+The native path downloads the matching release archive
+(`ai-memory-<os>-<arch>.tar.gz` on Unix, `ai-memory-windows-x86_64.zip` on
+Windows) and its `.sha256` sidecar from GitHub Releases, verifies the
+checksum, replaces the on-disk binary (and a sibling `hooks/` directory when
+present), then re-stages hooks for agents already under the data-dir hooks
+tree. Windows uses rename-aside (`.exe` → `.old`, then promote `.new`) because
+a running image cannot be overwritten in place. It refuses Homebrew/AUR/`/usr`
+installs (use the package manager), unwritable prefixes (for example Program
+Files — download the zip manually), and in-container binaries (upgrade the
+host wrapper/image instead). Windows aarch64 has no release asset yet. For
+mirrors or hermetic tests, set `AI_MEMORY_RELEASE_BASE_URL` (or
+`release_base_url` in config.toml) to a Releases-compatible base that serves
+`{base}/latest/tag` and `{base}/download/<tag>/<asset>` (+ `.sha256`). That
+override is a trust boundary: archive and checksum are fetched from the same
+base, so the `.sha256` only proves the base served a consistent pair, not that
+the binary is genuine — point it only at origins you control. Prefer an
+`https://` base; a plain-`http://` base has no transit protection, so an
+on-path attacker can substitute both the archive and its matching checksum.
+Each response body is capped at 128 MiB.
+
+### Shared notes
+
 When the upgraded server starts, it applies SQLite schema migrations and
 pending wiki-structure migrations automatically. No manual database
 reset or wiki rewrite is required for normal upgrades. Migrations are
@@ -2493,9 +2530,9 @@ non-destructive, but worth knowing about for your first session after upgrading:
   `AI_MEMORY_BACKFILL_ON_START=false`; run it by hand with `ai-memory backfill`.
 
 If the server runs on another host, `ai-memory upgrade` refreshes only
-the local wrapper, local image, and local hook scripts. Redeploy the
-remote server separately with `bin/deploy` or `docker compose pull &&
-docker compose up -d` in that deploy directory.
+the local client (wrapper/image or native binary) and local hook scripts.
+Redeploy the remote server separately with `bin/deploy` or
+`docker compose pull && docker compose up -d` in that deploy directory.
 
 Inside ai-jail or another bwrap sandbox, the wrapper is usable from the
 sandbox, but run `install-*` commands outside the sandbox because they