fix(cli): keep optional update notices nonblocking

[mldangelo-oai]

Summary

Keep optional update checks from delaying CLI output or leaving registry requests active after a command finishes.

Changes

• Pass a command-scoped cancellation signal to the existing npm update check.
• Preserve its existing bounded registry timeout while honoring command cancellation.
• Display an update notice only when it is already available after command execution.
• Abort unfinished checks on successful and exceptional command completion.
• Add focused regressions for caller cancellation and an update check that never settles.

Testing

• Confirmed the caller-cancellation regression failed before the production change.
• bun test tests-ts/update-notice.test.ts tests-ts/cli.test.ts tests-ts/cli-signals.test.ts tests-ts/cli-authentication.test.ts --timeout 30000 (168 passed).
• Re-ran bun test tests-ts/update-notice.test.ts --timeout 30000 after the final simplification (11 passed).
• pnpm --pm-on-fail=ignore run types.
• prettier --check src/cli.ts src/version.ts tests-ts/cli-fixtures.ts tests-ts/update-notice.test.ts.
• git diff --check.

Risk and rollout

Only optional update reporting changes. Ready notices, registry configuration, command output, credential handling, signal behavior, timeout limits, and suppression for CI, help, dry runs, and noninteractive output remain covered.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 776baaefc2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 776baaefc2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 776baaefc2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

[mldangelo-oai]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: a5fde56af6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: a5fde56af6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[zcrab-oai]

Looks good. Optional update notices remain nonblocking and unfinished registry requests are canceled without affecting command results.