docs: update plugin-dist clones with fetch and reset, not git pull

plugin-dist is rebuilt as one orphan commit and force-pushed on every
release, so the documented git pull fails with unrelated histories after the
first update, including the update SECURITY.md gives as the remedy for a
security fix. README and SECURITY.md now give fetch + reset --hard
FETCH_HEAD, and the other-agents bdt clone gets an update path too.

Closes #518

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpkeXRvikhJZSVGBFM91Dv
Signed-off-by: TM Hospitality Strategies <TMHospitalityStrategies@gmail.com>

Author: TMHSDigital

README.md

@@ -127,7 +127,14 @@ blender --background --python examples/bmesh-gear/bmesh_gear.py --
 Releases ship often; [CHANGELOG.md](CHANGELOG.md) lists what each one changed.
 
 - **Claude Code plugin** — `/plugin marketplace update blender-developer-tools` refreshes the marketplace and its plugins (from a shell: `claude plugin update blender-developer-tools@blender-developer-tools`). Remove it with `/plugin uninstall blender-developer-tools`, then `/plugin marketplace remove blender-developer-tools`.
-- **Cursor local plugin** — `git pull` in `~/.cursor/plugins/local/blender-developer-tools`, then reload the window. Remove that folder to uninstall.
+- **Cursor local plugin** and the **other-agents `bdt` clone** — `plugin-dist` is rebuilt as a single new commit and force-pushed on every release, so `git pull` refuses it ("unrelated histories"). Reset to the new build instead, then reload the Cursor window (for the `bdt` clone, re-run the copy commands above):
+
+  ```bash
+  git -C ~/.cursor/plugins/local/blender-developer-tools fetch origin plugin-dist
+  git -C ~/.cursor/plugins/local/blender-developer-tools reset --hard FETCH_HEAD
+  ```
+
+  Deleting the folder and cloning again does the same. Remove the folder to uninstall.
 - **Checkout** (per-project Cursor copies, the optional always-on Claude rules import, examples) — `git pull` in the clone. Copied `.mdc` files do not update themselves: symlink `rules/*.mdc` into `.cursor/rules/` instead of copying, or re-copy after each pull. To uninstall, delete the copied or linked rules and the `@.../blender-rules.md` line from your `CLAUDE.md`.
 
 ## Supported Blender versions

SECURITY.md

@@ -42,7 +42,9 @@ A confirmed fix lands on `main` and ships in the next release cut by
 commit on each release that changes plugin content, and the branch carries no
 tags, so a plugin install cannot be pinned to an older release. The remedy is to
 update the plugin (Claude Code: `/plugin marketplace update
-blender-developer-tools`; Cursor local plugin: `git pull` in its folder). A
+blender-developer-tools`; Cursor local plugin: `git fetch origin plugin-dist`
+then `git reset --hard FETCH_HEAD` in its folder, since a force-pushed orphan
+commit cannot be pulled). A
 checkout of `main` pins by release tag (`vX.Y.Z`) or tracks `main`, and its
 remedy is to move to the current release. Nothing older is patched in place.