refactor(updates): fetch version from registry instead of npm CLI to support multiple managers (#446)

## Background  
Addressing feedback from
https://github.com/openai/codex/pull/333#discussion_r2050893224, this PR
adds support for Bun alongside npm, pnpm while keeping the code simple.

## Summary  
The update‑check flow is refactored to use a direct registry lookup
(`fast-npm-meta` + `semver`) instead of shelling out to `npm outdated`,
and adds a lightweight installer‑detection mechanism that:

1. Checks if the invoked script lives under a known global‑bin directory
(npm, pnpm, or bun)
2. If not, falls back to local detection via `getUserAgent()` (the
`package‑manager‑detector` library)

## What’s Changed  
- **Registry‑based version check**  
- Replace `execFile("npm", ["outdated"])` with `getLatestVersion()` and
`semver.gt()`
- **Multi‑manager support**  
- New `renderUpdateCommand` handles update commands for `npm`, `pnpm`,
and `bun`.
  - Detect global installer first via `detectInstallerByPath()`  
  - Fallback to local detection via `getUserAgent()`  
- **Module cleanup**  
- Extract `detectInstallerByPath` into
`utils/package-manager-detector.ts`
- Remove legacy `checkOutdated`, `getNPMCommandPath`, and child‑process
JSON parsing
- **Flow improvements in `checkForUpdates`**  
  1. Short‑circuit by `UPDATE_CHECK_FREQUENCY`  
  3. Fetch & compare versions  
  4. Persist new timestamp immediately  
  5. Render & display styled box only when an update exists  
- **Maintain simplicity**
- All multi‑manager logic lives in one small helper and a concise lookup
rather than a complex adapter hierarchy
- Core `checkForUpdates` remains a single, easy‑to‑follow async function
- **Dependencies added**  
- `fast-npm-meta`, `semver`, `package-manager-detector`, `@types/semver`

## Considerations
If we decide to drop the interactive update‑message (`npm install -g
@openai/codex`) rendering altogether, we could remove most of the
installer‑detection code and dependencies, which would simplify the
codebase further but result in a less friendly UX.

## Preview

* npm

![refactor-update-check-flow-npm](https://github.com/user-attachments/assets/57320114-3fb6-4985-8780-3388a1d1ec85)

* bun

![refactor-update-check-flow-bun](https://github.com/user-attachments/assets/d93bf0ae-a687-412a-ab92-581b4f967307)

## Simple Flow Chart

```mermaid
flowchart TD
  A(Start) --> B[Read state]
  B --> C{Recent check?}
  C -- Yes --> Z[End]
  C -- No --> D[Fetch latest version]
  D --> E[Save check time]
  E --> F{Version data OK?}
  F -- No --> Z
  F -- Yes --> G{Update available?}
  G -- No --> Z
  G -- Yes --> H{Global install?}
  H -- Yes --> I[Select global manager]
  H -- No --> K{Local install?}
  K -- No --> Z
  K -- Yes --> L[Select local manager]
  I & L --> M[Render update message]
  M --> N[Format with boxen]
  N --> O[Print update]
  O --> Z
```

codex-cli/src/utils/package-manager-detector.ts

@@ -0,0 +1,73 @@
+import type { AgentName } from "package-manager-detector";
+
+import { execFileSync } from "node:child_process";
+import { join, resolve } from "node:path";
+import which from "which";
+
+function isInstalled(manager: AgentName): boolean {
+  try {
+    which.sync(manager);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getGlobalBinDir(manager: AgentName): string | undefined {
+  if (!isInstalled(manager)) {
+    return;
+  }
+
+  try {
+    switch (manager) {
+      case "npm": {
+        const stdout = execFileSync("npm", ["prefix", "-g"], {
+          encoding: "utf-8",
+        });
+        return join(stdout.trim(), "bin");
+      }
+
+      case "pnpm": {
+        // pnpm bin -g prints the bin dir
+        const stdout = execFileSync("pnpm", ["bin", "-g"], {
+          encoding: "utf-8",
+        });
+        return stdout.trim();
+      }
+
+      case "bun": {
+        // bun pm bin -g prints your bun global bin folder
+        const stdout = execFileSync("bun", ["pm", "bin", "-g"], {
+          encoding: "utf-8",
+        });
+        return stdout.trim();
+      }
+
+      default:
+        return undefined;
+    }
+  } catch {
+    // ignore
+  }
+
+  return undefined;
+}
+
+export async function detectInstallerByPath(): Promise<AgentName | undefined> {
+  // e.g. /usr/local/bin/codex
+  const invoked = process.argv[1] && resolve(process.argv[1]);
+  if (!invoked) {
+    return;
+  }
+
+  const supportedManagers: Array<AgentName> = ["npm", "pnpm", "bun"];
+
+  for (const mgr of supportedManagers) {
+    const binDir = getGlobalBinDir(mgr);
+    if (binDir && invoked.startsWith(binDir)) {
+      return mgr;
+    }
+  }
+
+  return undefined;
+}