feat: add Compass self-upgrade command

[forhappy]

Summary

• add a public compass upgrade command for official stable GitHub releases
• skip replacement with a clear success message when Compass is already current
• verify target-specific archives with SHA-256 and validate the staged binary version
• replace the running executable through a cross-platform self-replacement boundary
• document the command and include it in CLI help and the installed Compass skill reference

Why

Compass users currently need to repeat the installation flow manually to move to a newer release. This provides an explicit, safe in-place upgrade path while preventing downgrades and leaving the installed executable unchanged on validation failures.

User impact

Running compass upgrade now installs a newer stable release when available. Current or newer installations exit successfully without modification and explain why the upgrade was skipped.

Checks

• cargo fmt --all --check
• cargo test -p compass-cli --locked
• cargo clippy -p compass-cli --all-targets --no-deps --locked -- -D warnings
• cargo build -p compass-cli --bin compass --locked
• cross-target compile checks completed for Intel macOS and ARM64 Linux; Windows remains covered by the existing release CI matrix