Add self-update: sleeperagent update + Codex-style startup offer

[amanjaiman]

Why

Updating currently means re-downloading a release and re-running install --force (or go install). Codex CLI's flow is better: check for a newer version at startup, ask, and self-update on Y. This brings that to sleeperagent, and adds an explicit sleeperagent update command that permanently answers "how do I update this machine?"

What

• internal/update: resolves the latest release from the /releases/latest redirect (no API token, no rate limits), semver-compares against the goreleaser-stamped main.version, downloads the platform asset (sleeperagent_<ver>_<os>_<arch>.tar.gz|zip), verifies sha256 against the release's checksums.txt, and atomically replaces the executable. On Windows the running exe is parked as <exe>.old and cleaned up on the next start.
• sleeperagent update [--check] — explicit update; --check only reports.
• Startup offer: run/attach-existing from a real terminal check at most once a day (cached in the state dir), prompt Update now? [Y/n] before the session takes the terminal, and continue on the current version after updating. Never blocks startup: 3s timeout, silent on failure, skipped for dev builds and non-TTY runs.
• Opt-outs: [update] check = false in config.toml, or SLEEPERAGENT_NO_UPDATE_CHECK=1.
• Safety: checksum mismatch or any failure aborts without touching the installed binary.

CI

• The workflow's hand-kept integration list had drifted (missing dead_session and both interactive tests); it now runs test/run_all.sh directly and stamps the test binary with a version so the update test can run.
• Test scripts that give the binary a pty export SLEEPERAGENT_NO_UPDATE_CHECK so the startup prompt can never reach real GitHub from a test (this actually bit integration_pty.sh during development — it stalled on the prompt against the real v0.4.0 release).

Testing

• Unit tests: version comparison (incl. dev, pre-release suffixes, git-describe strings), redirect resolution, tar.gz/zip extraction, checksum rejection, missing-checksum rejection, the Windows .old swap, cache throttling.
• New test/integration_update.sh drives the real CLI against a fake release server: --check reports without installing, update swaps the executable (verified by executing the swapped-in payload), and a tampered asset is refused with the original binary untouched.
• Full suite: all 12 integration tests green in WSL tmux; gofmt/vet/go test ./... green on Windows.

🤖 Generated with Claude Code