feat(cli): add sm package-update to bump simple_module_* deps

[antosubash]

Summary

Adds a new sm package-update CLI command that walks the project's pyproject.toml (and any [tool.uv.workspace] members), finds dependencies whose distribution name starts with simple_module_ / simple-module-, queries PyPI for the latest non-yanked release, and rewrites each constraint to name>=<latest>.

• Deps backed by [tool.uv.sources] (workspace = true, path, git, url) are left untouched — those aren't installed from PyPI.
• Pre-releases are skipped by default (--include-pre opts in).
• --dry-run shows the planned changes without writing.
• PyPI lookups run in parallel via ThreadPoolExecutor; for a project with ~10 sm packages this is ~100ms instead of ~1s.
• Mutation uses tomlkit so existing formatting (comments, ordering, quoting) is preserved.
• After applying, the command prints a per-file change/skip summary and reminds the user to run uv sync.

Why

The host scaffolds dependencies like simple_module_core>=1.0,<2.0 and there's currently no convenient way to bump them all at once when new framework / module releases land on PyPI. This gives users one command to do it.

Notes for reviewers

• No new CLI deps. framework/cli/tests/test_no_framework_deps.py constrains the CLI package to typer + tomlkit. That's why version comparison uses a tiny custom _version_key helper instead of packaging.version.Version — the latter would break the invariant. The custom helper handles standard release versions correctly; ambiguous ordering between letter-suffixed pre-releases only matters under --include-pre, which is opt-in.
• PEP 508 parsing. _dep_name mirrors the more robust _parse_requirement_name in scripts/bump_version.py (handles markers ;, extras […], all PEP 440 ops). Logic is duplicated rather than imported because scripts/ isn't packaged with the CLI wheel.
• Test seam. run_update() is the importable entry point (accepts a fetcher injection); package_update() is the thin Typer wrapper. Keeps the --help output clean and tests deterministic without hitting the network.

Test plan

• uv run pytest framework/cli/tests/ — 94/94 passing (8 new tests).
• uv run ruff check + ruff format --check + ty check clean.
• uv run sm package-update --help renders cleanly with three flags.
• Manual smoke test against a scaffolded host with live PyPI (recommended before merging).