fix(updater): make CLI updates resilient and actionable

[francoischalifour]

Context

Automatic CLI update checks could crash otherwise successful commands when configuration or update-state persistence failed. Atomic writes also created temporary files outside the destination directory, which could cause cross-filesystem rename failures.

The updater experience had several related issues:

• Update notices were only displayed during a fresh daily network check, so cached updates disappeared from subsequent commands.
• Help output bypassed update notices entirely.
• update --clear-cache cleared the state but returned without performing the promised fresh check.
• Source checkouts recommended an unnecessarily verbose package-manager command and rejected the simpler altertable update --install flow.
• Native release binaries were version-checked only after replacing the existing executable.
• Human output included unnecessary installation and release metadata.

Proposed solution

This change makes the updater resilient, safe, and more actionable:

• Contain the complete automatic-check path so updater failures never interrupt the user’s command.
• Create temporary state and replacement files beside their destinations to preserve atomic same-filesystem renames.
• Keep the network refresh cadence daily while displaying cached update availability on eligible interactive commands until the user upgrades.
• Show cached update notices after root and subcommand help output.
• Make update --clear-cache immediately perform a fresh release check.
• Recommend altertable update --install unless a package-manager installation is positively detected.
• Route source checkouts through the detected package manager internally so the recommended command remains actionable.
• Verify downloaded native binaries before replacing the current executable.
• Preserve checksum validation, backup-and-rename replacement, and rollback behavior.
• Reduce human-facing update output to the version summary and installation command.

User-visible behavior

When an update is available: