fix(cli): add npm version check to squad upgrade command

[diberry]

Closes #46

Adds npm version check to the squad upgrade command to detect when an upgrade is available.

Fork PR for Copilot review gate.

[diberry]

🐕 FIDO Quality Review — PR #96 (Upgrade CLI Check)

Verdict: 🔴 Reject — scope creep with dangerous deletions

✅ The core feature is solid

• checkForNewerCLI() is well-designed: returns structured CLIUpdateCheck data, separating concern from the banner display in notifyIfUpdateAvailable().
• bypassCache option for the upgrade path is correct — you want a fresh check after upgrading.
• Cache TTL (24h), fetch timeout (3s), SQUAD_NO_UPDATE_CHECK opt-out all good.
• Tests cover: network failure → null, opt-out, cache hit, prerelease handling, malformed version, bypassCache.

🔴 BLOCKING: Massive unrelated file deletions

This PR deletes 8 files / 1,240+ lines that have nothing to do with the npm version check feature:

Deleted File	Impact
.github/workflows/squad-ci.yml (partial)	Removes changelog-gate, exports-map-check, and samples-build CI jobs — 265 lines of CI protection gone
.github/PR_REQUIREMENTS.md	PR review guidance deleted
.github/PULL_REQUEST_TEMPLATE.md	PR template deleted
scripts/check-exports-map.mjs	Exports validation script deleted
test/check-exports-map.test.ts	Tests for above deleted
test/guard-removal.test.ts	Guard removal tests deleted (211 lines)
.copilot/skills/bleed-check/SKILL.md	Skill definition deleted
.squad/skills/fork-first-pipeline/SKILL.md	Skill definition deleted

These deletions are not mentioned in the PR description, not justified, and remove safety infrastructure. The CI jobs in particular (changelog-gate, exports-map-check) were protecting against quality regressions. They need their own PR with rationale.

⚠️ Additional notes (would be non-blocking if scope were clean)

1. Malformed version handling is implicit: When npm returns 'not-a-version', compareVersions() calls parseVersion() which throws, caught by the outer try/catch → returns null. Works, but if someone changes parseVersion to not throw (returning defaults instead), this silently becomes a bug. An explicit format check before comparison would be safer.

2. fetchLatestVersion doesn't validate the returned string — just returns whatever dist-tags.latest contains from npm. Add a semver format check.

3. Decision files added are good — booster-ci-deletion-guard.md and retro-copilot-git-safety.md document important decisions.

Action required

Split out the file deletions into a separate PR with justification. The core checkForNewerCLI feature can ship independently.

[diberry]

🔧 Preparation Complete

• Rebased against upstream/dev
• Rebuilt branch — removed 160+ stowaway files (was 160+, now 9)
• Squashed to 1 commit
• Added changeset + CHANGELOG.md entry
• Naming convention: fix(cli): ✅
• Linked issue: Closes squad upgrade reports 'up to date' at 0.8.25 when 0.9.1 is published on npm #46
• CI green (10/10 checks passed, including changelog-gate)
• File audit: 9 CLI/test/docs files — clean

Advancing to squad:pr-needs-review.