DX: Self-Update — version check + binary replacement

[alexhraber]

Problem

Users running builddeck from a downloaded binary have no built-in way to know when a new version is available or to update. They must manually check GitHub releases, download, and replace the binary. The Buildkite CLI (bk update) handles this automatically with checksum verification.

Proposed Feature

Add a self-update mechanism with two parts:

1. Version Check on Startup

On launch, asynchronously check GitHub's latest release tag. If a newer version exists, show a subtle indicator in the header bar:

builddeck · my-org / my-pipeline · Refreshing · 2s · ⚠️ v1.2.0 available

The check must be:

• Non-blocking (TUI renders immediately, check runs in background)
• Rate-limited (check at most once per hour, persisted to config file)
• Fail-silent (no error shown if GitHub is unreachable)

2. Update Command

Add an update overlay triggered by a keybinding (e.g. U or ctrl+u when not in search mode):

┌──────────────────────────────────────┐
│  Update Available                    │
│                                       │
│  Current version:  v1.0.0            │
│  Latest version:   v1.2.0            │
│                                       │
│  Changelog:                           │
│  - feat: add trigger build overlay    │
│  - fix: handle DCS escape sequences   │
│  - perf: reduce memory in log view    │
│                                       │
│  [Download & Update] [Cancel]        │
└──────────────────────────────────────┘

The download should:

1. Fetch the release binary matching GOOS/GOARCH from GitHub
2. Download to a temp file
3. Verify SHA256 checksum from the release's .sha256 companion artifact
4. Copy over the current binary (with rename trick for cross-device safety)
5. Prompt: "Update complete. Restart now? (y/n)"

Why this fits a TUI

• Reducing friction to update means users stay on latest features and fixes
• The .sha256 checksum display is already a builddeck signature feature — using it for self-update is thematic
• Non-blocking startup check keeps the TUI feeling fast

References

• bk update in buildkite/cli
• GitHub Releases API: GET /repos/alexhraber/builddeck/releases/latest
• Existing .buildkite pipeline already produces .sha256 companion artifacts

Security

• Checksum verification: Downloaded binary must match the SHA256 from the release
• HTTPS only: All downloads from GitHub over TLS
• No auto-execute: User must confirm restart
• Fallback: On checksum mismatch, delete temp file and show error

Acceptance

• Async version check on startup (non-blocking)
• Version indicator in header when update available
• U key opens update overlay with changelog
• Download with progress indicator
• SHA256 verification against companion artifact
• Atomic binary replacement
• Restart prompt on success
• Fail-silent if GitHub unreachable