fix: CheckForUpdate() should return an error instead of conflating failure with no-update

[nathanhuh]

Summary

`CheckForUpdate()` in `internal/update/update.go` returns an empty string on both "no newer version available" and "network/parse error during check". Callers cannot distinguish the two states, so update check failures are silently swallowed — users never know when the check is broken.

Details

• Current signature: `func CheckForUpdate() string`
• On any error (HTTP failure, JSON parse failure, version parse failure), the function returns `""` — identical to "you are on the latest version"
• No logging occurs on failure, so there is no way to diagnose broken update checks

Checklist

• Change signature to `CheckForUpdate() (string, error)`
• Return explicit errors from HTTP, JSON, and semver parse failure paths
• Update all call sites to handle the new return signature
• Log or surface the error appropriately in the TUI (e.g., status bar note)
• Update `update_test.go` to cover the error path

References

• `internal/update/update.go:150-178`

Raised from senior code review (2026-05-12).