- Fetch manifest from CDN on every invocation, download and replace
  binary if a newer version exists
- Verify SHA256 checksum before replacing, extract from tar.gz or zip
- Skip update in dev builds, CI environments, or when auto_update is
  false in config.toml
- Run update check in background goroutine, print notice to stderr
  after command completes
- Add AutoUpdate *bool field to CLIConfig for opt-out

- Phase 1 (CheckForUpdate) fetches manifest and writes state file if newer version exists, with a short 3s timeout to avoid slowing down CLI startup
- Phase 2 (ApplyUpdate) reads state file on next run and applies the update with a 30s timeout
- Removes background goroutine and channel-based approach in favor of synchronous two-phase model
- State file (update.json) is cleared before applying so broken updates don't retry forever
- Adds UpdateState struct and read/write/clear helpers for on-disk persistence
- Adds tests for state file lifecycle, version comparison, download + checksum verification, and no-op when state file is absent

- Extract hardcoded cli.deepsource.com URL into buildinfo.BaseURL so dev builds can point to cli.deepsource.one
- Only skip auto-update for local dev builds (version == "development"), not all dev-mode builds
- Update tests to reflect the new behavior

- Strip pre-release/build suffix (e.g. "44-e888cf0f" → "44") before parsing patch version
- Fixes strconv.Atoi failure when version contains a commit hash

The CDN serves archives under /build/, but the URL was constructed
without it, causing 404 errors during self-update downloads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>