feat: surface update info via status and daemon startup

[StuBehan]

Summary

Best-effort PyPI update check that's script-friendly by default: the network call only fires from `stackvox status` and at daemon startup. Hooks, CI runs, `say`, `speak`, `stackvox-say` — every script path stays silent. Users see the notice when they're already looking at the terminal.

How it surfaces

Where	When	Output channel
`stackvox status`	Always (synchronous fetch with 2s timeout — already an interactive query)	stdout, alongside daemon state
`stackvox serve` startup	Once at boot, in a background thread	daemon's stderr log
Per-invocation stderr	Opt-in only via `STACKVOX_UPDATE_NOTICE=1` — reads cache, never fetches	stderr

Default behaviour

```
$ stackvox status
running (pid 12345) on /Users/.../daemon.sock
version: 0.3.1 (update available: 0.3.1 → 0.4.0 (run `pipx upgrade stackvox`))

$ stackvox serve
[stackvox] daemon listening on … (pid 12345)
[stackvox] update available: 0.3.1 → 0.4.0 (run `pipx upgrade stackvox`)
```

Disable / opt-in env vars

Var	Effect
`STACKVOX_NO_UPDATE_CHECK=1`	Disable entirely. No fetch, no notice.
`STACKVOX_UPDATE_NOTICE=1`	Print one-line stderr notice on every invocation (cache-only).
`CI`, `GITHUB_ACTIONS`, `BUILDKITE`, `CIRCLECI`, `GITLAB_CI`, `TRAVIS`	Auto-skipped to keep build logs clean.

Mechanics

• 24h cache at `~/.cache/stackvox/update-check.json` (`{"checked_at": "...", "latest": "..."}`).
• Cache TTL exceeded → re-fetch. Fetch failure → fall back to stale cache. No cache + failed fetch → silent no-op.
• 2s timeout, swallows all network/parse errors as best-effort.
• `_current_version()` reads installed metadata via `importlib.metadata` — late-bound to dodge a circular import.

Tests

24 new cases in `tests/test_updates.py`: version comparison (parametrized), disable env vars, cache I/O round-trip + corruption + missing-keys, fetch happy / error / malformed-JSON / disabled paths, `cached_update` and `check_for_update` freshness + stale-fallback, `format_notice`.

`tests/test_cli.py` adds a global fixture mocking `updates.check_for_update` / `cached_update` so the existing suite never hits PyPI, plus dedicated cases for status's update line and the opt-in notice.

108 tests, all green. ruff + mypy clean. Coverage of the new module is at 100% from the new tests.

Test plan

• CI passes.
• Manual: bump local pyproject to 0.0.1, run `stackvox status` — should fetch PyPI and report 0.3.1 (or whatever is current) is available.
• Manual: `stackvox serve` from a fresh terminal — daemon log includes update notice (or not, if you're on latest).
• Manual: `STACKVOX_UPDATE_NOTICE=1 stackvox say "hi"` — stderr has the notice.
• Manual: `STACKVOX_NO_UPDATE_CHECK=1 stackvox status` — no PyPI call, no notice.