feat: self-update command + background update notification

[ajianaz]

What

Add cora upgrade command for self-updating the binary, plus background startup notification that alerts users when a new release is available.

Why

Cora-code has no update mechanism — users must manually check GitHub releases and re-download. This creates version fragmentation and friction. Closes #508.

How

• cora upgrade — fetches latest release from GitHub (302 redirect parsing, no API rate limit), downloads tarball, verifies SHA256 checksum, smoke-tests binary, atomically replaces running binary
• Background notification — non-blocking std::thread::spawn on every command run, cached 24h at ~/.codecora/cora-code/update-cache.json, prints banner if update available
• Uses async reqwest (not reqwest::blocking like uteke) since cora-code main is async
• Version comparison normalizes GitHub tag prefix (v0.13.0 → 0.13.0)

Usage

cora upgrade --check   # Check only, no download
cora upgrade           # Interactive [y/N] prompt
cora upgrade --yes     # Auto-confirm (CI/automation)

Disable Background Notification

Config (~/.cora/config.yaml):

update_check: false

Environment:

export CORA_NO_UPDATE_CHECK=1

Testing

• cargo test passes (22/22: 16 unit + 6 config)
• cargo fmt --all -- --check passes
• cargo clippy passes (0 warnings)
• cargo build passes
• Manual smoke-test: cora upgrade --check correctly detects v0.13.0 as latest, shows "Already up to date"
• cora upgrade --help shows --yes and --check flags
• cora --help shows upgrade command in list
• cora upgrade --yes full download + replace (needs new release to test)

Related Issues

Closes #508

Checklist

• Branch name follows convention (feat/upgrade-command-508)
• Branch is from develop
• Commit messages follow Conventional Commits
• No secrets or credentials committed
• One logical change per PR (no mixed concerns)