feat(cli): What's New banner and task-grouped menu

[alxxjohn]

What & why

Running codeguard with no args (or help) previously printed a plain wall of flag signatures. This adds a What's New banner and reformats the command list into a task-grouped menu, both styled in codeguard's devr blue.

What's New banner

• Current version + a "update available" notice when a newer GitHub release exists.
• A few highlights parsed from the latest CHANGELOG.md section (stays in sync with release-please automatically).
• Update check is cached + opt-out: at most once per 24h (cached under os.UserCacheDir()/codeguard/update-check.json), disabled when CODEGUARD_NO_UPDATE_CHECK is set or $CI is present, uses the SSRF-guarded ai/safehttp client with a 1.5s timeout, and fails silent when offline.

Menu

• Commands grouped by task (Get started / Scan & baseline / Fix & report / Rules & policy / Serve & diagnose), aligned columns, one-line descriptions.
• Dense per-command flag signatures moved to codeguard <command> -h; a compact "Common flags" block remains.

Styling

• devr blue (RGB 37,169,255, matching report/text_banner.go) via shared whatsnew.Blue/BlueBold/Faint helpers.
• Color only on a real terminal; honors NO_COLOR / TERM=dumb and stays plain text when piped or redirected (cleaner than the report package, which always emits ANSI).

Bug fix (separate commit)

internal/version.Number was a const, but the linker's -X flag only sets vars — so .goreleaser.yaml's version injection was a silent no-op and every released binary reported 0.1.0. Changed to var; codeguard version and the banner now report the injected tag.

Tooling

• make menu previews the banner + menu with the real release version (from .release-please-manifest.json), and shows how to disable the update check.

Preview

╭────────────────────────────────────────────────────────────╮
  codeguard v0.6.1 (latest)
  What's new in v0.6.1 (2026-07-01):
    • security: harden untrusted-input handling and wire lint cleanup
╰────────────────────────────────────────────────────────────╯
codeguard — code quality, design, security, CI, and prompt-safety checks for your repository.

Usage: codeguard <command> [flags]

  GET STARTED
    init            Create a codeguard config file
    ...
  Common flags
    -config         Path to a config file or directory
    ...
Run codeguard <command> -h to see all flags for a command.

Knowledge captured

• .claude/knowledge/architecture-boundaries.md: notes that the usage menu makes one cached, opt-out outbound call, and the module-root go:embed constraint for CHANGELOG.md.

Testing

• go build ./..., go vet ./..., gofmt -l — clean
• golangci-lint run — 0 issues
• go test ./... — all pass (added parsing, semver, cache, GitHub fetcher (httptest), color, and menu-structure tests)

🤖 Generated with Claude Code