feat(update): auto-upgrade bsk when daemon finds a newer version

[BB-fat]

⚠️ Stacked on #76 — the diff shows cleanly once #76 merges; I'll retarget this PR to main then.

Motivation

#76 fixed the passive update check so hints actually fire. This PR goes one step further per maintainer decision: instead of only hinting, the daemon upgrades bsk automatically when it finds a newer release.

Behaviour

• The daemon's periodic update check (every 30 min) now, on finding a newer version: downloads the asset → verifies sha256 (refuses if the manifest has no checksum) → extracts → replaces the binary (atomic rename on Unix; staged on Windows) — all by reusing the existing bsk update install path, no duplicated logic.
• Session safety gate: if any agent session is live (same SessionRegistry the idle-exit logic uses), the round is postponed and retried on the next tick — automation is never killed mid-task. The session check is deliberately read after the fetch and before the replace to minimise the TOCTOU window.
• Self-restart (Unix): after replacing the binary, the daemon spawns a detached replacement process that waits for the old pid to exit, then the old daemon shuts down gracefully (existing select!/abort path, locks/socket/daemon.json cleanup included). The replacement inherits the running config (port/idle args). On Windows the binary can only be staged, so it just logs that a restart is needed.
• Default on, escape hatch: BSK_AUTO_UPDATE=off (case-insensitive, trimmed) restores the fix(update): run periodic update check in daemon so hints actually fire #76 hint-only behaviour. Same convention as BSK_REQUEST_HELP.
• Observable: every check/upgrade/skip/failure lands in the daemon rolling log with versions and action taken (UpToDate / Disabled / PostponedSessions / Replaced / Staged).
• CLI hint wording reflects the mode ("will upgrade automatically" vs "run bsk update"); the manual bsk update command is unchanged.

Tests

• 10 new unit tests: switch parsing (7 cases), session-gate postpone, install invoked exactly once when clear, disabled skips install, staged doesn't request a restart, error propagation, no-candidate, both hint wordings, restart-arg preservation.
• End-to-end against a locally served fake manifest (99.0.0): daemon auto-downloaded, verified, replaced the binary (inode changed), restarted, and the new daemon answered bsk status; with BSK_AUTO_UPDATE=off only the cache was written and the binary was untouched.
• cargo fmt --check, clippy -p bsk-protocol -p bsk --all-targets -D warnings: clean. cargo test -p bsk --lib: 226 passed; the single failure is the pre-existing, environment-dependent sync_continues_on_partial_error (fails identically on clean main).