feat(cli): fail the update when a project needs manual review

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/cli/src/update.ts

@@ -1315,6 +1315,33 @@ export async function runUpdate(dir: string, args: string[]): Promise<void> {
     }
   }
 
+  // Print the full report in a fixed order -- what changed, then what needs
+  // review and why, then what failed to parse -- so a scripted upgrade never
+  // has to guess at severity from console noise. A run with anything in
+  // needsReview or parseFailures exits non-zero: a project left half-migrated
+  // must never look like a clean success.
+  const allChangedAutomatically = [...reports.values()].flatMap((r) => r.changedAutomatically);
+  const allNeedsReview = [...reports.values()].flatMap((r) => r.needsReview);
+  const allParseFailures = [...reports.values()].flatMap((r) => r.parseFailures);
+
+  console.log(`\n  Changed automatically (${new Set(allChangedAutomatically).size}):`);
+  for (const line of new Set(allChangedAutomatically)) console.log(`    - ${line}`);
+
+  console.log(`\n  Needs review (${allNeedsReview.length}):`);
+  for (const line of allNeedsReview) console.log(`    - ${line}`);
+
+  console.log(`\n  Failed to parse (${allParseFailures.length}):`);
+  for (const line of allParseFailures) console.log(`    - ${line}`);
+
+  const needsAttention = allNeedsReview.length > 0 || allParseFailures.length > 0;
+  if (needsAttention) {
+    console.error(
+      `\n  ✗ ${allNeedsReview.length} item(s) need review and ${allParseFailures.length} file(s) failed to parse. ` +
+        `Resolve these by hand, then re-run wrnexus update.`,
+    );
+    process.exitCode = 1;
+  }
+
   if (dryRun) {
     console.log(`\n  Dry run — no files written. Re-run without --dry-run to apply.\n`);
     return;