bug(self-update): correct the version comparison, the HTTP errors and the binary replacement #8

Blocker: yes. Fix this before the server-monitoring work starts.

Defect

These defects are in internal/utils/version.go:

• release.TagName > version.Version compares text, not versions. Test result: "v0.1.10" > "v0.1.9" is false.
• Dev builds always find an update.
• The code does not examine the HTTP status code. A GitHub rate-limit response (403) gives an empty tag. Then, the CLI shows "You are already running the latest version."
• http.Get uses the default client. This client has no timeout.
• The code gets the release information two times. CheckForUpdates and getLatestRelease contain the same code.
• os.Rename moves the new binary from an os.MkdirTemp directory into /usr/local/bin. If /tmp is on a different filesystem, the move fails with EXDEV.
• The code starts the external tar command to extract the archive.

Cost

• When a version number gets two digits (for example v0.1.10), the installed CLIs do not see the update. These servers stay on the old version until a person installs a new version manually.
• Each release with this defect adds more servers that can stay on an old version.
• A rate limit gives an incorrect "latest version" message.
• A slow network connection can stop the update for an unlimited time.
• On servers where /tmp is on a different filesystem, the update fails.

Benefit of the fix

• The updater in the next release can install the self-update capability and all later releases.
• The update gives correct messages when GitHub returns an error.
• The update has a time limit. It operates on all filesystem layouts.

Fix

1. Compare versions with golang.org/x/mod/semver.
2. Get the release information one time. Use an http.Client with a timeout. Examine the status code. Send a User-Agent header.
3. Download to a temporary file in filepath.Dir(exe). Then, rename the file.
4. Extract the archive with archive/tar and compress/gzip.

Completion checks

• Unit test: v0.1.9 is less than v0.1.10.
• Unit test: dev builds get the correct result.
• Unit test: a 403 response gives an error, not "latest version".
• Unit test: the binary replacement occurs in one directory.

Checksum and signature checks are not part of this issue. Refer to #9.