v0.15.0 — add stitch self-update command

Added

• stitch self-update — checks the latest stable GitHub release, verifies
  the matching SHA-256 sidecar, narrowly validates the archive and ELF target,
  runs the staged binary's --version to catch incompatible builds, then
  atomically replaces the running executable without dropping ordinary
  ownership/mode metadata. --check is metadata-only, and JSON output reports
  up-to-date, newer, update-available, or updated.

Fixed

• Post-rename directory-sync failure no longer reports a failed update.
  When the atomic rename succeeds but fsync on the parent directory fails,
  the command now exits 0 with status: "updated" and a warning in the JSON
  envelope (and warning: on stderr in text mode). Previously this returned a
  non-zero exit with no success JSON, which could mislead an agent into
  retrying a no-op or reporting a failed update despite the binary being
  installed.