feat(cli): add self-update mechanism (MR-612)

- New `omnigraph update` subcommand: GitHub Releases API → archive download
  → SHA256 verification → atomic POSIX rename of both binaries.
- Detects Homebrew installs and short-circuits with a hint to run
  `brew upgrade ModernRelay/tap/omnigraph`.
- Channels: `--channel stable` (default) or `edge`. `--check` for
  check-only, `--yes` to skip the confirmation prompt.
- Best-effort startup version check (24h cached at
  `~/.cache/omnigraph/update-check.json`) with one-line stderr notice.
  Cache is refreshed via a detached `__refresh-update-cache` subprocess so
  the foreground command never blocks on the network. Suppression: CI,
  `OMNIGRAPH_NO_UPDATE_CHECK=1`, non-TTY stdout, and `version`/`update`
  subcommands.
- Integration tests use an in-process raw-TCP HTTP fixture (no extra
  dev-deps) and override `OMNIGRAPH_UPDATE_API_BASE` /
  `OMNIGRAPH_UPDATE_DOWNLOAD_BASE` to keep the suite hermetic.
- Docs: `install.md`, `cli.md`, `cli-reference.md` updated.

Co-Authored-By: Ragnor Comerford <ragnor.comerford@gmail.com>

crates/omnigraph-cli/src/main.rs

@@ -33,9 +33,12 @@ use serde_json::Value;
 
 mod embed;
 mod read_format;
+mod update;
+mod version_check;
 
 use embed::{EmbedArgs, EmbedOutput, execute_embed};
 use read_format::{ReadRenderOptions, render_read};
+use update::UpdateArgs;
 
 const DEFAULT_BEARER_TOKEN_ENV: &str = "OMNIGRAPH_BEARER_TOKEN";
 
@@ -52,6 +55,12 @@ struct Cli {
 enum Command {
     /// Print the CLI version
     Version,
+    /// Update the omnigraph binaries in place from GitHub Releases
+    Update(UpdateArgs),
+    /// Refresh the update-check cache. Internal — used by the detached
+    /// background refresh spawned at startup. Hidden from `--help`.
+    #[command(name = "__refresh-update-cache", hide = true)]
+    RefreshUpdateCache,
     /// Generate, clean, or refresh explicit seed embeddings
     Embed(EmbedArgs),
     /// Initialize a new repo from a schema
@@ -1587,11 +1596,22 @@ async fn main() -> Result<()> {
             .get_matches();
         Cli::from_arg_matches(&matches)?
     };
+    let skip_version_check = matches!(
+        cli.command,
+        Command::Version | Command::Update(_) | Command::RefreshUpdateCache
+    );
+    version_check::maybe_notify(env!("CARGO_PKG_VERSION"), skip_version_check);
     let http_client = build_http_client()?;
     match cli.command {
         Command::Version => {
             println!("omnigraph {}", env!("CARGO_PKG_VERSION"));
         }
+        Command::Update(args) => {
+            update::run(args).await?;
+        }
+        Command::RefreshUpdateCache => {
+            version_check::refresh_cache_subcommand().await?;
+        }
         Command::Embed(args) => {
             let output = execute_embed(&args).await?;
             if args.json {