fix(update): bypass GitHub raw CDN cache for self-update

The `crab update` command was reporting "Already up to date" even after
a new version was merged, because raw.githubusercontent.com serves
cached content (max-age=300). Add cache-busting via Cache-Control header
and timestamp query param. Also validate the downloaded file contains a
version string before replacing the binary.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mldangelo

src/crabcode

@@ -9308,10 +9308,17 @@ main() {
       local install_dir=$(dirname "$(realpath "$0")")
       local tmp_file="/tmp/crabcode-update-$$"
 
-      if curl -fsSL "https://raw.githubusercontent.com/promptfoo/crabcode/main/src/crabcode" -o "$tmp_file" 2>/dev/null; then
-        local new_version=$(grep '^VERSION=' "$tmp_file" | cut -d'"' -f2)
+      # Cache-bust to bypass GitHub raw CDN cache (max-age=300)
+      if curl -fsSL -H 'Cache-Control: no-cache' "https://raw.githubusercontent.com/promptfoo/crabcode/main/src/crabcode?t=$(date +%s)" -o "$tmp_file" 2>/dev/null; then
+        local new_version=$(grep '^VERSION=' "$tmp_file" | head -1 | cut -d'"' -f2)
         local current_version="$VERSION"
 
+        if [ -z "$new_version" ]; then
+          error "Downloaded file is invalid (no version found)"
+          rm -f "$tmp_file"
+          exit 1
+        fi
+
         if [ "$new_version" = "$current_version" ]; then
           echo -e "${GREEN}Already up to date (v$VERSION)${NC}"
         else