fix: harden CLI update, caching, logging, and storage reliability

[MrSnakeDoc]

📝 Description

This PR hardens Keg's reliability across package state caching,
self-updates, logging, HTTP handling, and filesystem storage.

Main changes:

• Fixed the Homebrew outdated-package cache persistence and
  reuse.
• Fixed self-updates when the existing binary is found outside
  the default path.
• Added rollback protection during binary replacement.
• Removed logger configuration deadlocks.
• Centralized logger output fallback handling.
• Formatted and serialized inline warning output safely.
• Closed HTTP response bodies on all relevant success and error
  paths.
• Rejected oversized downloads instead of silently truncating
  them.
• Added strict release metadata validation before updates.
• Prevented repeated Homebrew discovery when the installed
  package list is empty.
• Hardened filesystem store writes with rollback and context
  checks.
• Fixed path normalization around home-directory boundaries.
• Upgraded Go and module dependencies.
• Updated the golangci-lint configuration for gomodguard_v2.

This is intended to be a non-breaking reliability and
maintenance release.

🔗 Related Issue(s)

• None

🔄 Type of Change

• 🐛 Bug fix (non-breaking change fixing an issue)
• ✨ New feature (non-breaking change adding functionality)
• 💥 Breaking change (fix or feature with breaking changes)
• 📚 Documentation update
• 🔧 Code refactoring
• ⚙️ CI/CD pipeline update

📋 Checklist

• My code follows the project's style guidelines
• I have updated the documentation accordingly
• I have added tests for my changes
• All new and existing tests pass
• My changes don't affect performance negatively
• I have tested my changes on different Linux distributions
• I have verified Homebrew integration works correctly

📸 Screenshots (if applicable)

Not applicable.

🔍 Additional Notes

Validation performed:

• Targeted package tests pass.
• Broader tests pass except for the existing checker TLS test,
  which cannot create an IPv6 loopback listener in the current
  environment.
• golangci-lint reports 0 issues.
• govulncheck reports no vulnerabilities used by the project.

The full checker test limitation is environmental:

httptest.NewTLSServer fails because IPv6 loopback listening is
not permitted.