feat: add binary update/upgrade

[hchenxa]

What & why

#261

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Other:

Testing

GOCACHE=/private/tmp/san-go-build-cache go test ./...

Checklist

• Follows Conventional Commits (feat:, fix:, docs:, …)
• All commits signed off (git commit -s) — certifies the DCO
• Tests pass locally
• Docs updated (if behavior or config changed)
• Read and follow the Code of Conduct

[hchenxa]

/assign @yanmxa

[yanmxa]

Thanks @hchenxa — nice addition, and the test coverage is thorough! 🙏

One thing to fix before merge:

Cross-device rename will fail on many Linux setups. The binary is extracted into os.MkdirTemp("", ...) (i.e. $TMPDIR / /tmp), then installed with os.Rename(binPath, exe). When /tmp is a tmpfs (the systemd default on Fedora/Arch and others) and the binary lives on a different filesystem such as our default ~/.local/bin, os.Rename returns EXDEV ("invalid cross-device link") and the update aborts. Note install.sh gets away with the same move only because shell mv falls back to copy — os.Rename does not.

Suggested fix: create the temp dir next to the target binary, e.g. os.MkdirTemp(filepath.Dir(exe), ".san-update-*"), so the final rename stays on one filesystem (with a copy fallback on EXDEV if you want to be extra safe).

Minor: releases ship Windows as .zip, but the asset name is hard-coded to .tar.gz, so san update won't find a Windows asset — worth either handling .zip or explicitly noting Windows isn't supported yet.

[hchenxa]

@yanmxa this is a good suggestion. and I also add the windows ci testing, please take a look at again

[yanmxa]

LGTM — the EXDEV cross-device fix (temp dir next to the target binary + copy fallback) and the Windows .zip handling with the new Windows CI job both look good, and the test coverage is thorough.

I pushed one small follow-up commit: extractTarGz was missing the path-traversal guard that extractZip already has, so a crafted tarball entry could write outside the temp dir. Added the same check plus a test. Thanks for the solid work @hchenxa!