Make PromptKit version visible: session banner + CLI update check (#249)

* Announce PromptKit version when bootstrap loads

Add an instruction to bootstrap.md step 1 so the composition engine emits a one-line 'PromptKit v<version> loaded.' banner after reading manifest.yaml. The version is read from the top-level 'version:' field; a 'version unknown' fallback is used if the field is missing or unreadable, and no version is ever fabricated.

This applies to both manual loads and the 'promptkit interactive' (npx) flow, since the CLI stages the same bootstrap.md and manifest.yaml into a temp dir before instructing the LLM to read bootstrap.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Notify users when a newer PromptKit CLI version is available

Adds a best-effort daily update check to 'promptkit interactive'. The CLI queries https://registry.npmjs.org/<pkg>/latest (built-in https, ~1500ms timeout), caches the result in ~/.promptkit/update-check.json for 24h, and prints a boxed banner before spawning the LLM when a newer version exists. No new runtime dependencies.

Suppressed by NO_UPDATE_NOTIFIER=1, CI, non-TTY stdout, --no-update-check, and for non-interactive subcommands (list/search/show/--version). Network, cache, and parse failures are silently swallowed and never surface to the user.

Adds cli/tests/update-check.test.js with unit coverage for parseVersion, isNewer, formatBanner, and suppressionReason (no network I/O). Updates cli/tests/cli.test.js harness to copy the new lib/update-check.js into the temp CLI root.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Address PR #249 review: hard fetch deadline, validate cached version, add cache tests

- fetchLatest: add overall setTimeout that destroys the request so the 1500ms cap is a true deadline (not just socket-inactivity).

- fetchLatest + checkForUpdate: validate 'latest' with parseVersion before caching or returning, so an unparseable registry response can never poison the 24h cache.

- checkForUpdate: dispatch readCache/writeCache/fetchLatest through module.exports._internals so tests can stub them.

- Add tests for cache TTL hit, expired-cache refetch, pkg-name mismatch, unparseable cached value, and unparseable fetched value.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: anbeltra <anbeltra@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>