feat: notify terminal users about CLI updates

[bjarn]

Terminal users currently receive no notice when a newer CLI release is available. Add a background check against the public GitHub release API and show a notice on stderr at most once per 24 hours. Require the platform archive, installer, checksums, and provenance files before a release can trigger a notice.

Show update instructions for the detected installation method:

• Homebrew on macOS: refresh package data and upgrade the Lettermint cask.
• Shell installer on macOS or Linux: run the selected release installer with the existing installation directory. Verify the ownership record and executable hash, and quote custom paths.
• PowerShell installer on Windows: download the selected signed installer and run it with AllSigned. Read the existing ownership record, including records written by Windows PowerShell 5.1.
• Unknown method: show the archive for the current OS and architecture, plus the manual installation guide. Do not assume installer ownership from the OS alone.

Keep the cache separate from login data, use a non-blocking lock and atomic writes, and cancel unfinished requests when the command ends. Suppress checks for JSON, pipes, non-interactive use, help, version, completion, and raw message content. Listeners save new results for the next run. Short commands can exit before a new update is found. The CLI only prints instructions; it does not install updates.

Validation:

• go test ./...
• go test -race ./...
• go vet ./...
• Built a temporary binary with go build -buildvcs=false and passed scripts/test-terminal.py. Git metadata stamping is disabled only for this local test build because the managed worktree causes a Git status error.
• Passed a real terminal test for a release-version binary with a shell ownership record and a custom directory that contains an apostrophe.
• Tests cover complete releases on all six platforms, version comparison, daily limits, concurrent runs, cache failures, timeouts, cancellation, output modes, listener behavior, installer detection, invalid ownership records, and shell quoting. HTTP tests use local fixtures.