fix(versions): always fetch upstream latest, never compare pin-vs-pin

load_versions used env vars as "latest", but versions.env always
populates them via version-pins.sh — so the check compared pinned
values against themselves and reported "up-to-date" unconditionally,
even when npm had newer releases.

- Remove env-var shortcut from load_versions; always fetch from
  upstream (npm/github) for the reporting path
- Snapshot CLI overrides in version-upgrade.sh BEFORE version-pins.sh
  fills defaults, so explicit `CLAUDE_CODE_VERSION=X make versions-up`
  still forces that version at build time
- Plain `make versions-up` now correctly detects and upgrades to the
  real latest upstream versions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lroolle

scripts/release-utils.sh

@@ -418,36 +418,21 @@ load_versions() {
             set_current "$tool" ""
         fi
 
-        # Latest from source (respect env overrides)
-        local env_var latest_val
-        case $tool in
-            claude-code) env_var="CLAUDE_CODE_VERSION" ;;
-            claude-trace) env_var="CLAUDE_TRACE_VERSION" ;;
-            codex) env_var="CODEX_VERSION" ;;
-            gemini-cli) env_var="GEMINI_CLI_VERSION" ;;
-            atlas-cli) env_var="ATLAS_CLI_VERSION" ;;
-            copilot-api) env_var="COPILOT_API_VERSION" ;;
-            playwright) env_var="PLAYWRIGHT_VERSION" ;;
-            *) env_var="" ;;
-        esac
-
-        eval "latest_val=\"\${$env_var:-}\""
-        if [[ -n $latest_val ]]; then
-            set_latest "$tool" "$latest_val"
+        # Always fetch latest from upstream. versions.env populates env vars
+        # unconditionally, so checking them here would compare pin-vs-pin and
+        # always report "up-to-date". CLI overrides are respected at BUILD
+        # time (version-upgrade.sh), not at CHECK time.
+        local fetched
+        fetched=$(fetch_latest_version "$tool")
+        if [[ -n $fetched ]]; then
+            set_latest "$tool" "$fetched"
         else
-            local fetched
-            fetched=$(fetch_latest_version "$tool")
-            if [[ -n $fetched ]]; then
-                set_latest "$tool" "$fetched"
+            local current=$(get_current "$tool")
+            if [[ -n $current ]]; then
+                echo -e "${YELLOW}Warning: Failed to fetch latest $tool, using current: $current${RESET}" >&2
+                set_latest "$tool" "$current"
             else
-                # Network failure - fallback to current image version
-                local current=$(get_current "$tool")
-                if [[ -n $current ]]; then
-                    echo -e "${YELLOW}Warning: Failed to fetch latest $tool, using current: $current${RESET}" >&2
-                    set_latest "$tool" "$current"
-                else
-                    echo -e "${RED}Error: Cannot determine version for $tool${RESET}" >&2
-                fi
+                echo -e "${RED}Error: Cannot determine version for $tool${RESET}" >&2
             fi
         fi
 

scripts/version-upgrade.sh

@@ -7,6 +7,19 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=./release-utils.sh
 source "$SCRIPT_DIR/release-utils.sh"
+
+# Snapshot explicit CLI overrides BEFORE version-pins fills defaults from
+# versions.env. Makefile VERSION_QUERY_OVERRIDES only forwards vars whose
+# $(origin) is command-line/environment/override, so anything already set
+# here is a genuine user override — not a pin default.
+_CLI_CLAUDE_CODE="${CLAUDE_CODE_VERSION:-}"
+_CLI_CLAUDE_TRACE="${CLAUDE_TRACE_VERSION:-}"
+_CLI_CODEX="${CODEX_VERSION:-}"
+_CLI_GEMINI="${GEMINI_CLI_VERSION:-}"
+_CLI_ATLAS="${ATLAS_CLI_VERSION:-}"
+_CLI_COPILOT="${COPILOT_API_VERSION:-}"
+_CLI_PLAYWRIGHT="${PLAYWRIGHT_VERSION:-}"
+
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/version-pins.sh"
 
@@ -83,14 +96,15 @@ main() {
     echo -e "${GREEN}Proceeding with build...${RESET}"
     echo ""
 
+    # CLI override wins; otherwise use whatever load_versions fetched.
     local claude_ver claude_trace_ver codex_ver gemini_ver atlas_ver copilot_ver playwright_ver
-    claude_ver=$(get_latest "claude-code")
-    claude_trace_ver=$(get_latest "claude-trace")
-    codex_ver=$(get_latest "codex")
-    gemini_ver=$(get_latest "gemini-cli")
-    atlas_ver=$(get_latest "atlas-cli")
-    copilot_ver=$(get_latest "copilot-api")
-    playwright_ver=$(get_latest "playwright")
+    claude_ver="${_CLI_CLAUDE_CODE:-$(get_latest "claude-code")}"
+    claude_trace_ver="${_CLI_CLAUDE_TRACE:-$(get_latest "claude-trace")}"
+    codex_ver="${_CLI_CODEX:-$(get_latest "codex")}"
+    gemini_ver="${_CLI_GEMINI:-$(get_latest "gemini-cli")}"
+    atlas_ver="${_CLI_ATLAS:-$(get_latest "atlas-cli")}"
+    copilot_ver="${_CLI_COPILOT:-$(get_latest "copilot-api")}"
+    playwright_ver="${_CLI_PLAYWRIGHT:-$(get_latest "playwright")}"
 
     # Verify all required versions are set
     local missing=()