fix(make): use --pull always in up, split up-build for local source

'make up' now pulls the latest published image instead of rebuilding
from local context, which was overwriting freshly pulled images with
stale cache. New 'make up-build' target preserves the build-from-source
flow for developers iterating on the backend.

Closes #934

Makefile

@@ -2,7 +2,7 @@ VERSION ?= $(shell git describe --tags --abbrev=0 --match "v[0-9]*" 2>/dev/null
 LDFLAGS  = -s -w -X github.com/nextlevelbuilder/goclaw/cmd.Version=$(VERSION)
 BINARY   = goclaw
 
-.PHONY: build build-full build-tui run clean version up down logs reset test vet check-web dev migrate setup ci desktop-dev desktop-build desktop-dmg test-hooks test-hooks-unit test-hooks-e2e test-hooks-chaos test-hooks-rbac test-hooks-tracing
+.PHONY: build build-full build-tui run clean version up up-build down logs reset test vet check-web dev migrate setup ci desktop-dev desktop-build desktop-dmg test-hooks test-hooks-unit test-hooks-e2e test-hooks-chaos test-hooks-rbac test-hooks-tracing
 
 # Build backend only (API-only, no embedded web UI)
 build:
@@ -61,8 +61,15 @@ UPGRADE = docker compose -f docker-compose.yml -f docker-compose.postgres.yml -f
 version-file:
 	@echo $(VERSION) > VERSION
 
+# Pull latest published image (if changed) and start. Use for deploy/update flows.
 up: version-file
-	GOCLAW_VERSION=$(VERSION) $(COMPOSE) up -d --build
+	GOCLAW_VERSION=$(VERSION) $(COMPOSE) up -d --pull always
+	$(UPGRADE) run --rm upgrade
+
+# Build image from local source (with pulled base layers), then start. Use for dev changes.
+up-build: version-file
+	GOCLAW_VERSION=$(VERSION) $(COMPOSE) build --pull
+	GOCLAW_VERSION=$(VERSION) $(COMPOSE) up -d
 	$(UPGRADE) run --rm upgrade
 
 down:
@@ -73,7 +80,7 @@ logs:
 
 reset: version-file
 	$(COMPOSE) down -v
-	$(COMPOSE) up -d --build
+	GOCLAW_VERSION=$(VERSION) $(COMPOSE) up -d --pull always
 
 test:
 	go test -race -timeout=5m ./...