Auto-update on startup: prompt + apply + auto-restart

Double-clicking drover.exe now silently checks for updates first
(8s timeout, ignores network failures). If a newer release is
published, a YES/NO message box asks the user; on YES we download,
verify SHA256, apply via selfupdate, and re-launch the binary so
the user immediately sees the new version's window.

NO or no update → straight to the smoke-test window as before.
Update errors show an error dialog, then continue.

Implementation:
- internal/updater is reused as-is — the existing CheckForUpdate +
  ApplyUpdate API is enough.
- autoupdate_windows.go owns the dialog and re-launch logic
  (golang.org/x/sys/windows for MessageBoxW, os/exec for fresh
  process). autoupdate_other.go is the no-op stub for Linux CI.
- relaunchSelf uses cmd.Start (fire and forget) — no Wait. Current
  process os.Exit(0) immediately so the OS doesn't keep both
  generations of drover running.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/drover/main.go

@@ -45,10 +45,12 @@ func newRootCmd() *cobra.Command {
 		Version:       fmt.Sprintf("%s (commit %s, built %s)", Version, Commit, BuildDate),
 		SilenceUsage:  true,
 		SilenceErrors: false,
-		// No subcommand and no flags = end-user double-clicked the exe;
-		// open the smoke-test window instead of dumping CLI help to a
-		// console they didn't ask for.
+		// No subcommand and no flags = end-user double-clicked the exe.
+		// First do a quick update check (silent if no network or already
+		// current); if an update is available we prompt, apply, and
+		// re-launch ourselves. Then show the smoke-test window.
 		RunE: func(cmd *cobra.Command, args []string) error {
+			autoUpdateOnStartup()
 			showTestWindow()
 			return nil
 		},