feat(cli): add self-update mechanism (MR-612)

- New `omnigraph update` subcommand: GitHub Releases API → archive download
  → SHA256 verification → atomic POSIX rename of both binaries.
- Detects Homebrew installs and short-circuits with a hint to run
  `brew upgrade ModernRelay/tap/omnigraph`.
- Channels: `--channel stable` (default) or `edge`. `--check` for
  check-only, `--yes` to skip the confirmation prompt.
- Best-effort startup version check (24h cached at
  `~/.cache/omnigraph/update-check.json`) with one-line stderr notice.
  Cache is refreshed via a detached `__refresh-update-cache` subprocess so
  the foreground command never blocks on the network. Suppression: CI,
  `OMNIGRAPH_NO_UPDATE_CHECK=1`, non-TTY stdout, and `version`/`update`
  subcommands.
- Integration tests use an in-process raw-TCP HTTP fixture (no extra
  dev-deps) and override `OMNIGRAPH_UPDATE_API_BASE` /
  `OMNIGRAPH_UPDATE_DOWNLOAD_BASE` to keep the suite hermetic.
- Docs: `install.md`, `cli.md`, `cli-reference.md` updated.

Co-Authored-By: Ragnor Comerford <ragnor.comerford@gmail.com>

docs/cli.md

@@ -98,3 +98,20 @@ The config file can also define:
 
 When policy is enabled, `schema apply` is authorized through the
 `schema_apply` action and is typically limited to admins on protected `main`.
+
+## Updating
+
+Update both binaries in place from the latest GitHub Release:
+
+```bash
+omnigraph update              # default: stable channel, prompts for confirmation
+omnigraph update --check      # only check; do not install
+omnigraph update --yes        # skip prompt
+omnigraph update --channel edge
+```
+
+Homebrew installs are detected and short-circuited with a hint to run
+`brew upgrade ModernRelay/tap/omnigraph` instead. Each invocation of
+`omnigraph` also performs a best-effort cached check (24-hour TTL) for newer
+releases and prints a one-line stderr notice; suppress with
+`OMNIGRAPH_NO_UPDATE_CHECK=1`. Full details: [install.md](install.md).