feat: add M2 update check

[anandh8x]

Summary

• add zero update --check for latest GitHub release comparison
• add JSON output for automation and docs for the M2 check-only update flow
• centralize the CLI version constant used by commander and update checks

Validation

• bun test
• bun run typecheck
• bun run build
• bun run smoke:build
• bun run package:release
• compiled ./zero update --check --json with a stubbed release endpoint

[anandh8x]

Pushed a follow-up commit: efe20dc Harden update check version and timeout.

What changed:

• derive ZERO_VERSION from package.json so release bumps have one source of truth
• add a 5s default update-check timeout and pass AbortSignal through the fetch path
• document ZERO_UPDATE_RELEASE_URL precedence and allow full URLs or owner/repo slugs
• add tests for version sync, timeout signal wiring, endpoint precedence, and --json output

Validation:

• bun test 109/109
• bun run typecheck
• bun run build
• bun run smoke:build
• bun run package:release
• compiled ./zero --version and ./zero update --check --json with a stubbed endpoint
• GitHub CI green on Ubuntu, macOS, and Windows

[gnanam1990]

Reviewed by Hermes Agent. I checked the update-check implementation, CLI wiring, docs, and test coverage. Local validation passed with npx bun: bun test, bun run typecheck, and bun run build. LGTM.

[Vasanthdev2004]

Blockers

None found.

Non-Blocking

• zero update --check currently returns a provider-style failure when GitHub has no latest release yet. That matches the documented check-failed behavior, but once releases start this should be fine.
• feat: add M2 update check #16 and [codex] add m1 headless exec surface #17 both touch src/index.ts; I tested the combined merge path and it passes, but preserve both command registrations if resolving manually.

Looks Good

• ZERO_VERSION now comes from package.json, so release bumps have one source of truth.
• Endpoint resolution handles default repo, full URLs, and owner/repo slugs, with a 5s abort signal wired through fetch.
• JSON output is covered and suitable for automation.
• Validation passed locally in an isolated worktree: 109/109 tests, typecheck, build, smoke, package release, and diff-check. Combined feat: add M2 update check #16 + [codex] add m1 headless exec surface #17 merge also passed 117/117 tests and build.

Verdict: Approve — clean check-only update flow for M2.

[Vasanthdev2004]

Approved — update check flow, timeout/endpoint handling, JSON output, and version source-of-truth all checked out.