fix(updater): discard stale version hints

[Linxiushen]

Description

The npm wrapper now validates a persisted update hint against the installed npm package version before displaying it. This avoids launching the native binary in the CLI startup path. Hints for the current or an older version, malformed hints, and hints that cannot be compared safely are removed immediately; a valid newer hint is still shown.

Version parsing and comparison live in a shared module used by both the background updater and wrapper. Build metadata is accepted and ignored for precedence, and malformed inputs fail closed.

Closes #697.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring (no functional changes)
• Documentation update
• CI / Build / Tooling

How Has This Been Tested?

• node scripts/version.test.js
• go test ./...
• go vet ./...
• Manual testing (describe below)

The focused tests cover current, older, and newer versions; malformed hint and installed versions; build metadata; parsing; and stable-versus-prerelease cases.

Checklist

• My code follows the project's coding style (go fmt, go vet)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective
• New and existing unit tests pass locally with my changes
• Documentation is unchanged because the documented update behavior remains the same
• I have signed the CLA

AI Assistance

I used AI assistance to trace the stale hint lifecycle, extract the shared version helpers, and draft tests. I reviewed the final diff and ran the checks listed above.

Related Issues

Closes #697

[CLAassistant]

All committers have signed the CLA.

[github-actions]

🔍 OpenCodeReview found 3 issue(s) in this PR.

• ✅ Successfully posted inline: 3 comment(s)

[lizhengfeng101]

@Linxiushen Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.