Check workloads for available upgrades

Check all workloads (optionally filtered by group) for newer images available in their source registries. This is an offline metadata comparison; it does not pull images. Secret values are never returned.