feat(upgrade): implement awf upgrade self-update command

[pocky]

Summary

• Implements the awf upgrade self-update command (F076), which was previously a stub returning NotImplementedError
• Downloads platform-specific binaries from GitHub Releases, verifies SHA256 checksums, and atomically replaces the running executable with cross-filesystem fallback
• Adds --check, --force, and --version flags; warns when the binary appears managed by a package manager; supports GITHUB_TOKEN for rate-limited environments
• Reuses pkg/registry transport (already used by plugin and workflow pack installers) with no new application service layer — command is wired directly in the CLI interfaces layer

Changes

CLI Command

• internal/interfaces/cli/upgrade.go: New upgrade command implementing version check, GitHub release fetch, binary download + SHA256 verification, and atomic binary replacement via updater.ReplaceBinary(); flags: --check, --force, --version; package-manager path heuristic with --force escape hatch
• internal/interfaces/cli/root.go: Register upgradeCmd on the root command

Infrastructure

• internal/infrastructure/updater/replacer.go: New ReplaceBinary() function — resolves symlinks via EvalSymlinks, writes to temp file, atomically renames (with copy+chmod cross-FS fallback), and verifies the replaced binary is executable

Domain

• internal/domain/errors/codes.go: Five new typed error codes — USER.UPGRADE.VERSION_NOT_FOUND, USER.UPGRADE.ALREADY_LATEST, SYSTEM.UPGRADE.CHECKSUM_MISMATCH, SYSTEM.UPGRADE.BINARY_REPLACE_FAILED, SYSTEM.UPGRADE.DOWNLOAD_FAILED

Architecture

• .go-arch-lint.yml: Register infra-updater component; allow interfaces-cli to depend on it alongside existing infra components

Tests

• internal/interfaces/cli/upgrade_test.go: Table-driven tests covering update-available, already-latest, --check mode, --force, --version, checksum mismatch, permission error, and package-manager warning paths
• internal/infrastructure/updater/replacer_test.go: Unit tests for ReplaceBinary() covering same-FS success, cross-FS fallback, symlink resolution, and permission denial
• internal/domain/errors/codes_test.go: Extend existing exhaustive constant, uniqueness, and exit-code tests to include all five new upgrade error codes

Documentation

• docs/user-guide/upgrade.md: New reference page covering all flags, authentication, and troubleshooting
• docs/user-guide/commands.md: Add awf upgrade, --check, and --version rows to command table
• docs/README.md: Link to new upgrade guide
• README.md: Add awf upgrade to the quick-reference command table
• CHANGELOG.md: Document F076 under [Unreleased] → Added
• CLAUDE.md: Add two new pitfall entries for symlink-aware binary replacement and package-manager path warnings

Test plan

• awf upgrade --check against a repo with a newer release reports the available version without modifying the binary
• awf upgrade downloads, verifies checksum, and replaces the binary; awf version reflects the new version after execution
• awf upgrade --version v0.5.0 installs the specified older version (downgrade path)
• Unit and integration tests pass: make test

Closes #298

---

Generated with awf commit workflow