(feat): adding update command

[lifeofpavs]

Summary

Adds jup update — a self-update command that fetches and runs install.sh from the matching release tag, which handles volta/npm/binary detection and installation internally.

Update command

• jup update — fetches install.sh from the release tag URL, writes it to a secure temp directory (mkdtemp), and executes it
• jup update --check — reports whether an update is available without installing
• Version detection via GitHub REST API (/repos/jup-ag/cli/releases/latest)
• Supports both JSON and table output formats

install.sh hardening

1. Secure temp file creation

The original script wrote to a predictable path (/tmp/jup), which is vulnerable to symlink attacks — an attacker could place a symlink at /tmp/jup pointing to another file, and the script would overwrite it. The fix uses mktemp -d for a unique temp directory and trap for cleanup:

TMP_DIR=$(mktemp -d)
TMP_BINARY="${TMP_DIR}/${BINARY}"
trap 'rm -rf "$TMP_DIR"' EXIT

2. Checksum grep error handling

Under set -e, if grep finds no matching checksum line it returns exit code 1, killing the script with no useful message. The fix suppresses the exit and provides an actionable error:

EXPECTED=$(grep "$ASSET" "$TMP_CHECKSUMS" | awk '{print $1}') || true
if [ -z "$EXPECTED" ]; then
  error "No checksum found for $ASSET in checksums.txt"
fi

[lifeofpavs]

Addressed in a follow-up. The updater now creates a unique temp directory with mkdtemp(...), writes install.sh inside that directory with mode 0o700, and removes the directory in finally, so the predictable temp-file path is gone.