feat: self-update command + startup update notification

[ajianaz]

Feature: Self-Update (cora upgrade) + Startup Notification

Problem

Cora Code has no built-in update mechanism. Users must manually re-run install.sh to upgrade. There is no notification when a new version is available.

Proposed Solution

1. cora upgrade command

cora upgrade          # Check + prompt [y/N]
cora upgrade --yes    # Auto-confirm (CI/automation)
cora upgrade --check  # Check only, no download

Flow:

1. Detect current version (env!("CARGO_PKG_VERSION"))
2. Detect OS/arch (std::env::consts)
3. GET GitHub releases/latest → parse 302 redirect (no API rate limit)
4. Compare versions → show release notes link
5. Prompt [y/N] (skip with --yes)
6. Download cora-{target}-{version}.tar.gz
7. Verify SHA256 from checksums-sha256.txt (already generated by CI)
8. Path traversal protection (validate archive entries)
9. Smoke-test new binary (cora --version)
10. Atomic replace (cora.new → cora)
11. Cleanup temp

Reference: uteke already has a proven implementation (uteke upgrade).

2. Startup update notification (background, non-blocking)

• Check latest version in background thread on every cora invocation
• Cache result for 24 hours at ~/.codecora/cora-code/update-cache.json
• Print banner to stderr if update available:

⚠ Update available: v0.14.0
  Run `cora upgrade` to update (currently v0.13.0)

• Opt-out via config: update_check: false in config

3. Path standardization (partial)

All new data goes to ~/.codecora/cora-code/ (using existing data_dir.rs).

Dependencies

Add to Cargo.toml:

flate2 = "1"
tar = "0.4"

Files

File	Description
src/commands/upgrade.rs	Self-update command (~250 lines)
src/commands/update_check.rs	Background notification + cache (~100 lines)
src/data_dir.rs	Add update_cache_path() helper
src/commands/mod.rs	Register modules
src/main.rs	Command enum + dispatch + startup hook
src/config/schema.rs	Add update_check config field
Cargo.toml	Add flate2, tar

Non-goals (separate issue)

• Migrate existing ~/.cora/ paths (config, auth, scan-cache) to ~/.codecora/cora-code/
• Windows .zip support for upgrade (Linux/macOS first)