fix(update): bypass GitHub raw CDN cache for self-update (#22)

## Summary
- `crab update` was always reporting "Already up to date" after a new
version was merged because `raw.githubusercontent.com` serves cached
content (`max-age=300`)
- Added cache-busting via `Cache-Control: no-cache` header and a
timestamp query parameter to force fresh downloads
- Added validation that the downloaded file actually contains a version
string before replacing the installed binary

## Test plan
- [ ] Run `crab update` immediately after merging a version bump —
should detect the new version instead of reporting "Already up to date"
- [ ] Run `crab update` when already on latest — should correctly report
"Already up to date"
- [ ] Simulate a corrupted download (e.g. empty file) — should error
with "Downloaded file is invalid" instead of replacing the binary

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: mldangelo

src/crabcode

@@ -9713,10 +9713,17 @@ main() {
       local install_dir=$(dirname "$(realpath "$0")")
       local tmp_file="/tmp/crabcode-update-$$"
 
-      if curl -fsSL "https://raw.githubusercontent.com/promptfoo/crabcode/main/src/crabcode" -o "$tmp_file" 2>/dev/null; then
-        local new_version=$(grep '^VERSION=' "$tmp_file" | cut -d'"' -f2)
+      # Cache-bust to bypass GitHub raw CDN cache (max-age=300)
+      if curl -fsSL -H 'Cache-Control: no-cache' "https://raw.githubusercontent.com/promptfoo/crabcode/main/src/crabcode?t=$(date +%s)" -o "$tmp_file" 2>/dev/null; then
+        local new_version=$(grep '^VERSION=' "$tmp_file" | head -1 | cut -d'"' -f2)
         local current_version="$VERSION"
 
+        if [ -z "$new_version" ]; then
+          error "Downloaded file is invalid (no version found)"
+          rm -f "$tmp_file"
+          exit 1
+        fi
+
         if [ "$new_version" = "$current_version" ]; then
           echo -e "${GREEN}Already up to date (v$VERSION)${NC}"
         else