feat(upgrade): implement binary self update

[DeanThompson]

Summary

Implements apimux upgrade for direct binary installs and makes schema-bound source command help resilient when the service schema cannot be reached.

Motivation

apimux upgrade --check already reports newer releases, but apimux upgrade returned cli_upgrade_not_implemented. Also, dynamic source command help could return cli_transport_error if schema lookup failed, which makes help unusable in misconfigured/offline scenarios.

Changes

• Add update.Upgrade() to download the platform archive, verify checksums, extract apimux, and atomically replace the current executable.
• Keep upgrade --check as a non-mutating manifest check.
• Return clear errors for symlink/package-manager/unwritable installs so users can use their package manager or rerun the install script.
• Make schema-bound --help fall back to static help with a schema lookup warning instead of failing with transport errors.
• Add unit tests for successful upgrade, checksum mismatch, symlink rejection, up-to-date upgrade output, and help fallback.

References

Implementation follows the existing api-egress-gateway update pattern: GitHub release asset download, checksum verification, tar extraction, and atomic rename. lark-cli was also checked for install-side checksum/mirror practices.

Testing

• go test ./...
• git diff --check
• go run ./cmd/apimux --base-url http://127.0.0.1:1 amazon get_product --help
• APIMUX_CLI_RELEASE_MANIFEST_URL=https://github.com/reorc/apimux-cli/releases/latest/download/latest.json go run -ldflags "-X github.com/reorc/apimux-cli/internal/buildinfo.Version=1.1.4 -X github.com/reorc/apimux-cli/internal/buildinfo.ReleaseManifestURL=https://github.com/reorc/apimux-cli/releases/latest/download/latest.json" ./cmd/apimux upgrade --check