feat(cli): add machineid update self-update command

[christiangda]

Summary

Adds machineid update, a self-update verb for the CLI only. The importable library gains no code, no network access and no dependencies; everything lives in internal/selfupdate (standard library only) and cmd/machineid/update.go is a thin adapter.

Builds on #15 (Go 1.27 bump), now merged. Design and rationale: .plan/update-command.md (local, not committed), modelled on rrcli update in ds-utils with the private-repo machinery removed.

How it works

• No API, no token. The newest tag comes from the redirect that github.com/slashdevops/machineid/releases/latest returns, a tag's existence from its release page, and assets from releases/download/<tag>/<name>. None of these carry the REST API's 60 req/h unauthenticated quota. Downloads only follow redirects to github.com and *.githubusercontent.com.
• Hourly budget. At most 5 live lookups per rolling hour per user, the answer cached for an hour in the user cache directory (0600). -check serves the cache and, over budget, still answers from the stale cache with the next allowed time; a real update refuses with exit 1. MACHINEID_UPDATE_BUDGET overrides, 0 disables. A GitHub 429/403 Retry-After is persisted as a backoff. A corrupt or unwritable state file never blocks an update.
• Nothing runs unasked. Normal machineid runs never touch the network; there is no background check and no nag. Root is never requested; the remedy prints the sudo command.
• Install paths. Linux zip and the new macOS universal zip replace the binary in place via atomic rename. The macOS .pkg is used only when the running binary is in /usr/local/bin. go install is the fallback and the only method on Windows (no Windows assets are published). Both fixed-destination methods are guarded against installing somewhere other than the running binary; -force overrides.
• Verification. SHA-256 always. Sigstore bundle via cosign when installed, Apple signature via pkgutil / codesign; -require-signature makes a skipped check fatal.
• Exit codes. 0 ok / current / -check / declined, 1 prerequisite not met (nothing attempted), 2 bad arguments (as elsewhere in the CLI), 3 attempted and failed.

Release pipeline

release.yml now also publishes machineid-darwin-universal.zip + .zip.sha256 from the signed universal binary. Asset names are pinned by internal/selfupdate/asset_test.go and documented in CONTRIBUTING as a contract.

Decisions taken (say if you want any changed)

	Chosen
Exit codes	0/1/2/3, keeping 2 = invalid arguments CLI-wide
Budget	5 per hour, env override
Signatures	opportunistic by default, strict with -require-signature
Auto-check	never
macOS zip	published in this PR
Location	internal/selfupdate, unimportable from outside the module

Verification

• gofmt, vet, golangci-lint (0 issues), go test -race ./... on darwin; vet + test binaries compile for linux and windows; go fix / betteralign / modernize clean.
• Tests use an in-memory fake GitHub (httptest.NewTestServer), a fake exec and an injected clock; nothing reaches the real network.
• Smoke test with a dev build against the real GitHub: live lookup resolved v0.1.3 (4 of 5 checks left this hour), a second -check was served from cache, and the install-target guard refused a binary outside /usr/local/bin with the -force remedy (exit 1). A normal machineid -debug run logged no network activity.

The first release the updater can move from is the one that ships it; it can move to any tag that carries assets, including older ones via -version.

🤖 Generated with Claude Code