No way to see which machines are running an old version, or to update in place #16

Motivation

v0.3.0 carried security fixes (#6). Rolling it out meant running ./install.sh --host … against each machine from a clone, by hand, from memory. Nothing in the tool says which hosts are stale — cc-peer list --host web-01 reports sessions, not the version of cc-peer sitting on that box.

With four machines that is tedious. It is also the case where being out of date matters most: the fleet is exactly what a messaging tool touches.

Proposed

Show the remote version in list. The cheapest fix and probably the most useful — the discovery call already runs the script over there, so it can report its own version alongside the sessions.

$ cc-peer list --host build-server
build-server: cc-peer 0.2.0 (this machine: 0.3.0)
...

cc-peer update [--host …]. Fetch the latest release from GitHub and reinstall, same paths install.sh uses. --check to report without changing anything.

Two things to get right:

• No self-overwrite mid-run. The script is running from the file being replaced. Write to a temp path and move it into place.
• Air-gapped hosts have no internet — that is one of the reasons this tool exists (README). update --host should push from here over SSH, the way install.sh --host already does, rather than assuming the target can reach GitHub. A direct update on a machine with no route out should say so plainly instead of hanging.

Version comparison can stay simple: the tag is vX.Y.Z and __version__ matches it. Comparing the strings via a tuple of ints is enough; no dependency needed.

Acceptance criteria

• list --host shows the remote cc-peer version and flags a mismatch
• update --check reports current vs latest without writing
• update replaces the installed copy safely while running from it
• update --host pushes over SSH, no internet needed on the target
• Version comparison covered by unit tests