fix(version-self-check): clear timer in finally + unref to avoid event-loop pin

Codex review feedback on PR #21. The previous implementation only
cleared the abort timer on the success path — when `fetchImpl`
rejected (network error, malformed body), the catch block returned
null but the timer was left running until it fired. In a long-lived
MCP server that's invisible (the timer just expires harmlessly
seconds later), but in short-lived processes / tests it would
prevent the event loop from exiting cleanly.

Two-line fix:
- `timer.unref()` (Node-only, optional-chained for portability) so
  the timer alone never keeps the loop alive.
- `clearTimeout(timer)` moved into a `finally` block so it runs on
  both success and exception paths.

Belt-and-braces by design: either fix alone is sufficient, but
together they leave no path for a stray timer.

19 version-self-check tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: critesjosh

src/utils/version-self-check.ts

@@ -49,18 +49,29 @@ export async function fetchLatestNpmVersion(
   timeoutMs: number = 2000,
   fetchImpl: typeof fetch = fetch
 ): Promise<string | null> {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  // `unref` (Node-only) prevents this timer from keeping the event
+  // loop alive on its own. Critical for short-lived processes and
+  // tests where a forgotten timer would block exit. Optional-chained
+  // because `setTimeout` in browser-shaped environments returns a
+  // primitive number with no `unref` — the optional call is safe.
+  (timer as unknown as { unref?: () => void }).unref?.();
   try {
-    const ctl = new AbortController();
-    const timer = setTimeout(() => ctl.abort(), timeoutMs);
     const resp = await fetchImpl(NPM_REGISTRY_URL, { signal: ctl.signal });
-    clearTimeout(timer);
     if (!resp.ok) return null;
     const data = await resp.json();
     if (!data || typeof data !== "object") return null;
     const v = (data as Record<string, unknown>).version;
     return typeof v === "string" ? v : null;
   } catch {
     return null;
+  } finally {
+    // Always clear: the previous implementation only cleared on the
+    // success path, leaking the timer when `fetchImpl` rejected
+    // (network error, CORS, malformed body) before the timeout
+    // fired. Combined with `unref` above this is belt-and-braces.
+    clearTimeout(timer);
   }
 }