fix: detect source checkout updates

[namabeeru]

What

• Keep the release-tag update check as the primary version signal, then compare source checkouts against origin/main when the tag is unchanged.
• Add the missing POSIX scripts/updater.sh used by macOS/Linux update flows.
• Reuse the current Python executable when updater scripts reinstall and relaunch CraftBot, and use --ff-only pulls to avoid accidental updater merges.
• Add focused updater tests for release-vs-source precedence, git edge cases, script selection, and POSIX launcher arguments.

Why

Source installs can be behind main while still having the latest tagged app version in settings.json, so the UI can incorrectly say CraftBot is up to date. On macOS/Linux, perform_update() also pointed at scripts/updater.sh, but that script was not versioned.

How to test

• /usr/local/bin/python3.10 -m pytest tests/test_updater.py -q
• Repeated the focused updater suite 20 times: all passes.
• /usr/local/bin/python3.10 -m ruff format --check app/updater.py tests/test_updater.py
• /usr/local/bin/python3.10 -m ruff check app/updater.py tests/test_updater.py
• /usr/local/bin/python3.10 -m compileall -q app agent_core agents decorators skills
• sh -n scripts/updater.sh && bash -n scripts/updater.sh && git diff --check
• Live probe from this source checkout: check_for_update() returned (True, '1.4.0', '1.4.0+main.546cce5') while the checkout was 2 commits behind origin/main.

Known unrelated result on current dev:

• /usr/local/bin/python3.10 -m pytest tests -q currently reports 107 passed, 16 deselected, and 4 failures in tests/test_trigger_router_and_parking.py because the test FakeLLM.generate_response_async() does not accept prompt_name.

Screenshots / Logs

Not UI-facing; behavior is covered by the test output above.