Switch to native Claude Code installer and add update command

Replace the deprecated npm installation with the native installer. The
binary is installed to /usr/local/bin so it survives the home directory
bind mount at runtime.

Add a 'claude update' subcommand that rebuilds the image with the latest
Claude Code binary and removes all existing containers.

Disable the in-container auto-updater since the binary lives in the
read-only image layer.

README.md

@@ -14,6 +14,7 @@ the host.
 - **Hard linking support**: Can hard link files like `~/.gitconfig` to share configurations with containers
 - Mounts only the current project directory (same absolute path inside container)
 - **Security boundary**: No access to SSH keys, passwords, or full `$HOME` (intentionally prevents remote code pushes)
+- **Easy updates**: `claude update` rebuilds the image with the latest Claude Code
 - Simple shell function (`claude`) to launch interactively
 
 ## Install
@@ -55,6 +56,21 @@ The image is built automatically on first use if it does not already exist.
 Claude Code starts inside the container with the current directory mounted and
 set as the working directory.
 
+### Updating Claude Code
+
+To update Claude Code to the latest version:
+
+```
+claude update
+```
+
+This rebuilds the Docker image with the latest Claude Code binary and removes
+all existing containers. Containers are recreated automatically on the next
+run. The persistent home directory is not affected.
+
+The in-container auto-updater is disabled because Claude Code is installed in
+the image layer. Use `claude update` to get new versions.
+
 ## Sharing host config files via hard links
 
 The container home at `~/.local/share/claude-container/container-home/` is mounted