feat: add upgrade nudge

[bhdicaire]

This Pull Request adds a pull-based upgrade nudge for vanityURLs instances.

Detail

This PR adds an opt-in upstream release checker that compares the instance package version to public GitHub releases for vanityURLs/code.

It includes:

• a reusable upstream release checker
• a manual node scripts/check-upstream-release.mjs command
• an opt-in npm run doctor -- --check-upstream notice
• a monthly GitHub Actions workflow template that opens or updates one tracking issue when an instance is behind
• documentation for privacy-preserving usage and security-release markers
• maintenance test coverage for security-release detection

The nudge is dormant by default. It does not phone home, does not send instance links or configuration upstream, and network failures remain non-fatal.

Checks

• npm run check
• npm run test:maintenance
• npm run doctor -- --json
• npm run doctor -- --json --check-upstream

Notes

The workflow template still uses action version tags. Before enforcing this mechanism broadly, we should pin workflow actions to full commit SHAs.

[bhdicaire]

Maintainer-authored PRs may be merged by the author after required checks pass.
Second human review is required for releases, security-sensitive changes, and repository governance changes.