Add numan update --self for CLI binary upgrades

AGENTS.md

@@ -58,7 +58,8 @@ src/
     snapshot.rs        — `numan snapshot list|inspect|delete|rollback` (Phase 5.3)
     deactivate.rs      — Plugin + module deactivation: journaled plugin unregister (`execute_with_unregistrar`); module full/partial (Phase 4 / Issue #22 PR2)
     plugin_lifecycle.rs — Activate/deactivate-owned lifecycle boundary exposed to opt-in update orchestration (Issue #22 PR3)
-    update.rs          — `numan update [--check] [pkg]`: upgrades; active plugins orchestrate deactivate→upgrade→activate only with exact env opt-in (Phase 5 / Issue #22 PR3)
+    update.rs          — `numan update [--check] [pkg]`: upgrades packages; `numan update --self [--check]`: self-replace standalone binary (or print brew/winget/cargo upgrade); active plugins orchestrate deactivate→upgrade→activate only with exact env opt-in (Phase 5 / Issue #22 PR3)
+    self_update.rs     — GitHub Release self-update for `update --self` (install-method detection, SHA256SUMS verify, atomic/Windows-safe binary replace)
     remove.rs          — `numan remove [--force] <pkg>`: remove from lockfile + delete payload (Phase 5); `--force` bypasses module activation only (active plugins always gated until deactivate, Issue #22)
     gc.rs              — `numan gc [--dry-run]`: delete orphaned payload directories (Phase 5)
     nupm.rs            — `numan nupm status|inspect|import|diff`: nupm discovery + import + drift (Phase 6.1–6.3)

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`numan update --self`**: upgrade the numan CLI itself. Standalone installs download the matching GitHub Release asset, verify `SHA256SUMS` (corruption check; assets are not separately signed), and replace the binary in place. Homebrew / winget / cargo installs print the exact upgrade command instead of self-replacing. Pair with `--check` to report without applying (standalone only; managed installs still print the upgrade hint).
+
 ## [0.2.0] - 2026-08-05
 
 ### Added

README.md

@@ -281,13 +281,16 @@ numan deactivate owner/module-name
 #### 5. Maintain installs
 
 ```bash
-numan update --check              # see available upgrades
-numan update                      # apply upgrades
+numan update --check              # see available package upgrades
+numan update                      # apply package upgrades
+numan update --self --check       # standalone: report if a newer binary is available
+numan update --self               # standalone: download, checksum-verify, replace binary
 numan remove owner/package-name
 numan gc --dry-run                # preview orphaned payload dirs
 numan gc                          # delete unreferenced payloads
 ```
 
+For Homebrew, winget, or `cargo install` installs, `numan update --self` and `--self --check` both print the matching upgrade command (`brew upgrade numan`, `winget upgrade tonythethompson.numan`, or `cargo install --locked --force numan-cli`) instead of downloading a release asset. Standalone checksum verification guards against truncated or corrupted downloads; release assets are not separately signed.
 numan snapshots activation state before `update`, `remove`, `activate`, and `deactivate`, so a bad change can be undone:
 
 ```bash
@@ -348,6 +351,7 @@ Global flag: `--root <path>` — override the numan root directory (all commands
 | `numan activate [pkg...]` | Register plugins / write module autoloads (scripts and completion packages are deferred) |
 | `numan deactivate [pkg...]` | Remove module autoload entries |
 | `numan update [--check] [pkg]` | Upgrade installed packages |
+| `numan update --self [--check]` | Upgrade the numan binary (GitHub Release self-replace, or print brew/winget/cargo command) |
 | `numan remove [--force] <pkg>` | Remove from lockfile and delete payload |
 | `numan gc [--dry-run]` | Delete orphaned package directories |
 | `numan snapshot list` | List all committed activation snapshots |
@@ -377,7 +381,7 @@ Global flag: `--root <path>` — override the numan root directory (all commands
 | `install` | `--force` reinstall; `-v` / `--verbose` |
 | `activate` | `--verbose`; `--list` status only; `--check` integrity only |
 | `deactivate` | `--verbose` |
-| `update` | `--check` report only; `-v` / `--verbose` |
+| `update` | `--check` report only; `--self` update the numan binary; `-v` / `--verbose` |
 | `remove` | `--force` remove despite active activation |
 | `gc` | `--dry-run` preview only |
 | `registry add` | `--key <base64-public-key>` (required for custom registries; official is auto-configured on `init`) |

src/cmd/mod.rs

@@ -13,6 +13,7 @@ pub mod plugin_lifecycle;
 pub mod registry;
 pub mod remove;
 pub mod search;
+pub mod self_update;
 pub mod setup;
 pub mod snapshot;
 pub mod try_cmd;