Tell the user when a newer release exists (check-for-updates)

[Jorgelig]

Today there is no way to learn that an arrow update shipped: no in-app hint and no CLI flag. This adds a lightweight check-for-updates that reports a newer release and points at it — it never downloads or installs anything (arrow is unsigned, so a silent in-app updater would fight Gatekeeper; the signed auto-updater stays deferred).

• Lib (src/update.rs): check_update(current) → UpdateStatus, an opt-in, secondary network layer kept out of the parser hot path (build_report/file_content never call it). Shells out to curl (no new HTTP dependency), time-boxed (--max-time), and degrades to an honest error instead of panicking. Strict semver-ish comparison, so a weird/non-numeric tag never spuriously claims an update.
• CLI: arrow --check-update [--json] — prints current vs latest and, when newer, the release URL + the installer one-liner.
• Tauri: check_update() (runs off the UI thread via spawn_blocking) and open_url() (https-only) commands.
• UI: the VersionBadge checks once on mount and, when a newer release exists, shows a green dot + "Update available → vX.Y.Z" with an "Open release" button. In the browser dev build it stays silent.
• Docs: README / CLAUDE / ROADMAP updated — the "no auto-update" note now reflects the check, with tauri-plugin-updater + a Homebrew Cask still on the roadmap.

Honesty

It only ever says "update available" when a latest was fetched, parsed, and is strictly newer; any failure (offline, rate-limited, no release) is silent in the UI / an explicit message in the CLI. It never claims to auto-install.

Testing

• New unit tests: version ordering, v-prefix normalization, honest failure status.
• Verified live: arrow --check-update against this repo prints arrow is up to date (v0.1.6); --json returns {current, latest, updateAvailable, url, error}.
• cargo test (24) + cargo clippy clean on both crates, frontend builds.

Branches off main, independent of the worktree-clean PR.