feat: "newer version available" notice on pcr runs + start CHANGELOG.md

[KaluJo]

Summary

Adds an update-notifier on every interactive pcr command. Modeled
on the npm update-notifier package and cargo's own behaviour:

• Background refresh at command start. Fires a 3 s-timeout
  GET https://registry.npmjs.org/pcr-dev/latest on a detached
  thread, writes the result to ~/.pcr-dev/update-check.json. The
  thread is never joined — slow DNS / captive portals / network
  failures never delay the user's primary signal. Registry hit is
  rate-limited to once per 24 h via the cache TTL.

• One-line notice at command end. Reads the cache; if the cached
  pcr-dev@latest is greater than CARGO_PKG_VERSION under naive
  major.minor.patch semver AND we haven't shown the notice in the
  last hour (so back-to-back pcr log; pcr show stays quiet),
  prints:

    ┌─ pcr 0.3.0 is available (you have 0.2.9)
    └─ run: brew upgrade pcr
  

• Install-method-aware suggestion. Inspects current_exe() for
  /Cellar/, /opt/homebrew/, or /node_modules/ and prints the
  right upgrade command (brew upgrade pcr, npm i -g pcr-dev@latest,
  or a generic install link).

• Quiet by default for machines and scripts. Hard skips:

  • --json output (would corrupt JSON-RPC / piped consumers)
  • pcr hook and pcr mcp (internal stdio channels)
  • CI=* env (CI runners don't need the nag)
  • PCR_NO_UPDATE_CHECK=1 (explicit opt-out)

• Forward-compatible cache schema. Older cache payloads without
  the last_notice_unix field decode cleanly (covered by a regression
  test) so a CLI upgrade never silently disables the notice forever.

Also adds CHANGELOG.md — none previously existed in this repo —
seeded with an [Unreleased] section that catalogues this feature
plus the in-flight fixes from PRs #85 (vscode dual-watch dedup) and
#86 (watcher correctness + perf) so they have a single grep-able
home when those PRs merge into the next release.

README gets a short "Update notifier" subsection under "CI / agent
use" documenting PCR_NO_UPDATE_CHECK and the quiet-subcommand list.

Why now

Triggered by user feedback: "if you do pcr anything and there's a
new update available it should tell me". pcr ships through three
distribution channels (npm, Homebrew, raw releases), so users on
older versions never get notified when a fix lands — unless they
manually npm outdated -g or brew upgrade. This closes that loop.

The check goes through the npm registry (not GitHub Releases) because
the npm dist-tag is the authoritative "latest" pointer — Homebrew's
formula auto-updates from the npm release after the GitHub Release
workflow finishes, and direct-download users are presumed to be the
ones manually managing versions.

Branching

Off main rather than stacked on fix/vscode-dual-watch-dedup /
fix/watcher-shutdown-perf-correctness. No file overlap with either,
and the feature is useful immediately at v0.2.9 without waiting for
those PRs to merge.

Test plan

• cargo fmt --all --check clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace — 134 passed across all binaries, 0 failures (was 128 on this main baseline; +6 new tests in update_check::tests):
  • semver_compare_basic — straight numeric comparisons
  • semver_compare_handles_prerelease_suffix — beta tags don't trigger demotion prompts
  • semver_compare_rejects_malformed — garbage versions never falsely "newer"
  • cache_roundtrip_through_serde — JSON round-trip integrity
  • cache_decodes_partial_legacy_payload — forward-compat with older caches
  • quiet_subcommands_skip — hook + mcp correctly suppressed
• cargo build -p pcr-cli --release succeeds, pcr --version and PCR_NO_UPDATE_CHECK=1 pcr status smoke-tested locally.

Future polish

• The 60 s startup latency for pcr start means the notice (printed at end) is only seen when the user Ctrl-Cs. Could move the print earlier for start specifically, but kept end-of-command for v1 simplicity.
• Could light up the notice format with ANSI dim/bold if stderr_is_terminal() and !NO_COLOR; deliberately kept plain for v1 to avoid fighting colour-discipline elsewhere.
• Migration path: when PR watcher correctness + perf: graceful shutdown, mtime-cached scans, single-row UPDATEs, pcr_dir fail-loud #86 (pcr_dir() -> Result<PathBuf>) merges, swap cache_path() to use ? and drop the marker comment — noted inline.

Made with Cursor