refactor(cli): move update-check policy to the CLI owner

[thymikee]

Parent: #2129

Blocked by: none. Wave 1; update-check policy remains a CLI/update concern and must not be treated as generic HTTP or host-file mechanics.

Scope — exact tracked files

Production:

• src/utils/update-check.ts
• src/utils/update-check-entry.ts

Tests:

• The utility source has no tracked test under src/utils; keep and update the existing src/__tests__/update-check.test.ts.

Destination and importer/build edits

Move to:

• src/cli/update-check.ts
• src/cli/update-check-entry.ts

Update exactly these production importers:

• src/cli.ts -> src/cli/update-check.ts

Update the exact tsdown entry in tsdown.config.ts from the old utility path to src/cli/update-check-entry.ts. Update src/__tests__/update-check.test.ts to import the new owner. Preserve the worker entry's standalone packaging shape and lazy registry access.

Behavior invariants

Preserve the npm latest-version request, 14-day cache interval, cache-file format, timeout, CI/test/help/json/version opt-outs, notifier eligibility, detached worker argument parsing, and best-effort failure handling. Do not turn the update worker into a general transport owner or load it eagerly in the CLI startup closure.

Focused validation

Run:

• pnpm vitest run src/__tests__/update-check.test.ts
• the CLI startup/import-closure and build packaging checks covering internal/update-check-entry
• pnpm check:affected --run

Planted-red proof

No new structural rule is added. Temporarily change the cache interval or enable the notifier for a help/JSON invocation and observe the named update-check test fail; restore the policy before the green run. Verify the tsdown entry resolves only after the move and does not reintroduce a compatibility alias.

Dependency order

Wave 1. This child is independent of snapshot, host, transport, provisioning, command/core, surface, Swift, and video moves. The terminal child is blocked by it.

Shrink target

Delete both old utility files. The CLI destination must be a move with no duplicate worker or re-export and no production LOC growth after discounting the physical move. No src/utils/update-check* path may remain in tracked packaging or imports.