fix(client): prevent stale service replacement

[kitlangton]

What

Prevent an older CLI or Desktop client from replacing a newer managed background service.

Before / After

Before

A client required its exact installed version. After an update, an older client saw the newer service as incompatible and replaced it with the older binary. A newer client could then replace that service again.

After

CLI and Desktop accept a service at the same or a newer comparable version. A newer client still sees an older service as incompatible, so normal automatic upgrades continue.

flowchart TD
  A[Client discovers service] --> B{Service version >= client?}
  B -->|Yes| C[Reuse service]
  B -->|No| D[Existing replacement path]

Loading

How

• packages/client/src/service-version.ts compares stable and numeric preview versions and conservatively accepts incomparable development versions.
• packages/cli/src/services/service-config.ts uses the compatibility predicate for managed startup.
• packages/desktop/src/main/background-cli.ts applies the same policy.
• Client tests verify numeric ordering and that a stale real child-process client neither stops nor replaces a newer service.

Scope

This PR only changes version compatibility policy. It does not change stop authentication, PID signaling, Promise registration validation, migration polling, service election, or TUI presentation.

Testing

• cd packages/client && bun run test
• cd packages/client && bun typecheck
• cd packages/cli && bun run test test/server-connection.test.ts --test-name-pattern 'service options'
• cd packages/cli && bun typecheck
• cd packages/desktop && bun typecheck
• Repository pre-push typecheck: 34 packages passed

[kitlangton]

Closing because this encodes the wrong rollback policy. Older Desktop must be able to intentionally downgrade its managed service; treating every newer service as compatible creates a partial rollback where the UI downgrades but the server does not. We will track replacement authority and the concrete scenarios in a separate design issue.