feat: updatecheck foundation package (PR-01 of 5)

[shivasurya]

Summary

• Adds sast-engine/updatecheck/ as a purely additive, zero-callers foundation package implementing the full version-check pipeline from the version-update-check tech spec.
• No behavior change for users — the package is unimported until PR-02 (CLI) and PR-03 (MCP) land.
• 100% statement coverage on all new files.

What's in this PR

File	Purpose
manifest.go	Wire types (Manifest, ManifestLatest, ManifestAnnouncement), public Result/UpgradeNotice/Announcement/Options, Fetch() with context-scoped timeout
semver.go	Strict MAJOR.MINOR.PATCH parser, Compare(), Match() with < <= > >= = and space-separated AND
select.go	selectUpgrade() (info/warn escalation via min_supported) and selectAnnouncement() with 6-tier priority, audience filter, time-window, dismissed-IDs, and version_range semver filter
check.go	Check() orchestrator; opt-out via DisableCheck flag and PATHFINDER_NO_UPDATE_CHECK env var (build tag !noupdatecheck)
check_noop.go	Stub returning nil for distros using -tags noupdatecheck

Stack

PR-01 (this) — updatecheck pkg, no callers
  ├── PR-02 — CLI integration (cmd/root.go + banner)
  │     └── PR-04 — analytics wiring
  └── PR-03 — MCP server integration
        └── PR-04 — analytics wiring
PR-05 — release/latest.json + publish workflow (parallel)

Verification

cd sast-engine
go test -coverprofile=cover.out ./updatecheck/...
go tool cover -func=cover.out | tail -1
# total: (statements) 100.0%

go build -tags noupdatecheck ./...
golangci-lint run ./updatecheck/...
# 0 issues

Test plan

• go build ./... — zero issues
• go test ./updatecheck/... — all tests pass
• go tool cover — 100.0% statement coverage
• golangci-lint run ./updatecheck/... — 0 issues
• go build -tags noupdatecheck ./... — noop stub compiles
• Zero callers outside updatecheck/ (grep -r "updatecheck" . --include="*.go" --exclude-dir=updatecheck returns empty)

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	11
Rules	205

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.87%. Comparing base (0fbf2cd) to head (24b3fe9).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #651      +/-   ##
==========================================
+ Coverage   84.75%   84.87%   +0.11%     
==========================================
  Files         165      169       +4     
  Lines       24403    24594     +191     
==========================================
+ Hits        20682    20873     +191     
  Misses       2937     2937              
  Partials      784      784              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shivasurya]

• feat: release/latest.json manifest and publish workflow #655
• feat: analytics reach measurement for update notices (PR-04) #654
• feat: MCP server integration for version update check (PR-03) #653
• feat: CLI integration for version update check #652
• feat: updatecheck foundation package (PR-01 of 5) #651 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[shivasurya]

Merge activity

• Apr 12, 2:24 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 12, 2:24 PM UTC: @shivasurya merged this pull request with Graphite.