#1238 feat(cli): print an update notice when a newer e2e is on npm

After a command on a terminal, e2e now prints a notice when npm has a newer release, so people get reminded to upgrade.

Update available 0.20.0 → 0.21.2
Run pnpm add -D e2e@latest to update. Changelog: https://github.com/tester-army/e2e/blob/main/packages/e2e/CHANGELOG.md

• packages/e2e/src/cli/update-check.ts: at most one registry request a day, started in preAction while the command runs and awaited in main's finally next to the telemetry flush (1.5s timeout). The answer is cached in ~/.config/e2e/update-check.json, so every command between checks reminds with no request. A failed request still counts as a check, so offline machines don't pay for it on every run.
• Install command: the nearest packageManager field or lockfile at or above the cwd decides the package manager, so apps/web in a pnpm monorepo gets pnpm add. At a pnpm workspace root it adds -w.
• Silent in CI, when stderr isn't a TTY, from a source checkout, for e2e mcp, and under E2E_UPDATE_CHECK_DISABLED, NO_UPDATE_NOTIFIER, E2E_TELEMETRY_DISABLED, or DO_NOT_TRACK. A saved e2e telemetry disable does not stop it, same as e2e feedback.
• latestRelease/olderThan moved from cli/feedback.ts to internal/release.ts so both share them. package-manager.ts gets fieldManager/lockfileManager, both extracted from detectPackageManager.
• Docs: CLI reference, environment reference, and both security pages, which used to say only e2e feedback contacts npm.

Verified

Ran it locally: yes

Surface: packed CLI (pnpm pack) installed into scratch projects in /tmp, with the installed version set to 0.20.0, run inside a pseudo-terminal (script) so stderr is a TTY.

Scenario	Result
First run, npm project	Real registry request, notice with npm install --save-dev e2e@latest, 0.5s total
Second run	Read from cache with no request (0.15s)
apps/web in a pnpm workspace (lockfile at root)	pnpm add -D e2e@latest
pnpm workspace root	pnpm add -D e2e@latest -w
Piped stderr, CI=1, DO_NOT_TRACK=1, --version	No notice