feat(cli): support exact-version updates without npm discovery

[XIQIXIQIXIQI]

What this PR does

Adds qwen update --target-version <version> for standalone installations. An explicit target skips npm version discovery and installs that exact release through the existing download and verification flow, including QWEN_UPDATE_BASE_URL. Omitting the option preserves normal update discovery.

Concrete stable and prerelease versions accept an optional leading v. Explicit requests allow same-version reinstalls and downgrades. Invalid targets are rejected before downloading, and a downloaded executable reporting a different version is rejected before activation. Unsupported installation methods return an actionable error instead of suggesting an unpinned upgrade. Help and error text are localized.

Why it's needed

Operators may already have selected a release while npm registry access is unavailable. Configuring a reachable artifact source alone does not help because the current update command performs registry discovery first. Explicit selection makes that dependency unnecessary and prevents discovery from choosing a different release.

Reviewer Test Plan

How to verify

• Run an explicit-version update with a custom HTTPS release root while npm registry access is unavailable. It should install exactly the selected version without invoking npm or contacting a registry.
• Try a concrete prerelease, a same-version reinstall and an explicit downgrade. Each should use the specified version and retain the previous installation for rollback.
• Try a mutable tag, malformed version, missing argument, unavailable archive, incorrect checksum or an archive whose executable reports a different version. Failures must preserve the original installation and clean up update locks and temporary files.
• For a non-standalone installation, expect a nonzero exit and instructions to install the selected version manually, without an unpinned package-manager command.
• Omit the target option and confirm that normal version discovery remains in use.

Evidence (Before & After)

Before: the installed CLI's update help has no target-version option; source always runs version discovery before downloading.

After: focused unit tests pass, and isolated CLI tests use a local HTTPS release source with registry access unavailable to verify exact installation and failure preservation. Detailed E2E evidence is posted separately.

Validation: full build, workspace typecheck, bundle, 170 focused tests, changed-file ESLint and Prettier checks passed. The npm lockfile was used for final validation; the optional pnpm layout exceeded an unrelated document-export asset budget, while the npm build passed that gate.

Tested on

OS	Status
macOS	Tested: build, typecheck, unit tests and isolated CLI E2E
Windows	Not tested locally
Linux	Baseline update help only; new implementation not tested locally

Environment (optional)

Node.js 22.23.1. E2E runs use isolated home directories and disposable installations, a local HTTPS server with a temporary trusted CA, and network/subprocess guards. Downloaded fixtures contain a real Node runtime and a small version-reporting CLI; this verifies updater behavior, not the functionality of a complete new release. No real installation was updated.

Risk & Scope

• Main risk or tradeoff: explicit requests intentionally permit reinstalls and downgrades. Version equality is now checked before activation for all standalone update entrypoints.
• Not validated / out of scope: Windows deferred replacement, full release-package acceptance, daemon/UI upgrade orchestration and release approval policies.
• Breaking changes / migration notes: existing calls without the option retain version discovery; malformed versions are rejected more strictly.

Linked Issues

Closes #11484

中文说明

本 PR 的改动

为独立安装新增 qwen update --target-version <version>。指定目标时跳过 npm 版本查询，通过现有下载与校验流程安装该精确版本，并继续支持 QWEN_UPDATE_BASE_URL。不指定参数时保留原有版本查询行为。

支持具体稳定版和预发布版本，以及可选的 v 前缀。显式请求允许同版本重装和降级。非法目标在下载前拒绝；下载后若程序报告的版本与目标不一致，则在激活前拒绝。不支持的安装方式返回可操作的错误提示，避免建议一个未固定版本的升级命令。帮助与错误文案已本地化。

需求背景

用户可能已经确定要安装的版本，但无法访问 npm registry。仅配置可访问的制品源仍然不够，因为当前升级命令会先查询 registry。指定版本可以移除这个依赖，并避免版本发现选择另一个版本。

审查者验证计划

验证方法

• 在 npm registry 不可用时，结合自定义 HTTPS 下载源执行指定版本升级。应准确安装目标版本，不调用 npm，也不访问 registry。
• 验证具体预发布版本、同版本重装和显式降级。每种情况均应使用指定版本，并保留旧安装以供回退。
• 验证可变标签、非法版本、缺少参数、制品不存在、校验不匹配和包内程序版本不匹配。失败必须保留旧安装，并清理锁与临时文件。
• 非独立安装应返回非零退出码，提示手动安装指定版本，不输出未固定版本的包管理器升级命令。
• 不提供目标参数时，应继续执行原有版本查询。

修改前后证据

修改前：已安装 CLI 的升级帮助中没有指定版本参数；源码在下载前始终查询版本。

修改后：相关单测通过；隔离 CLI 测试使用本地 HTTPS 制品源，在 registry 不可用的条件下验证准确安装及失败保护。详细 E2E 证据单独评论发布。

验证通过：完整构建、工作区类型检查、bundle、170 项相关测试，以及改动文件的 ESLint 和 Prettier 检查。最终验证使用 npm 锁文件；可选 pnpm 布局触发了无关的文档导出体积限制，npm 构建通过了同一门禁。

测试平台

• macOS：构建、类型检查、单测和隔离 CLI E2E 已验证。
• Windows：未在本地验证。
• Linux：仅检查基线升级帮助，未在本地验证新实现。

验证环境

Node.js 22.23.1。E2E 使用隔离 HOME、临时安装、本地 HTTPS 服务、临时受信 CA，以及网络和子进程监测。下载制品由真实 Node 运行时和精简的版本输出 CLI 组成，证明的是升级器行为，而非完整新版本的功能验收。未升级任何真实安装。

风险与范围

• 显式指定版本允许重装和降级；所有独立升级入口都会在激活前核对版本一致性。
• 未覆盖 Windows 延迟替换、完整发布包验收、daemon/UI 升级编排或版本审核策略。
• 未指定参数时保留现有行为；非法版本校验更加严格。

关联并关闭 #11484。

[XIQIXIQIXIQI]

Independent E2E verification

11/11 passed on macOS ARM64 with Node.js 22.23.1, using the updated CLI bundle and disposable standalone installations.

Scenario	Result
Exact version + custom HTTPS download root	Installed requested version; previous installation retained
Same-version reinstall	Passed
Explicit downgrade	Passed
Concrete preview version	Passed
Downloaded executable reports another version	Rejected; original installation fingerprint unchanged
SHA256 mismatch	Rejected; original installation fingerprint unchanged
Mutable tag	Rejected before downloads
Path traversal	Rejected before downloads
Version range	Rejected before downloads
Missing target argument	Rejected before downloads
Default update without target	Still attempts npm discovery; intentionally blocked by the test guard

Every explicit-target case recorded zero npm subprocesses and zero registry requests. TLS certificate verification remained enabled with a temporary local CA. Successful downloads requested the archive, checksum file and optional signature only from the configured HTTPS root. Update locks and temporary extraction files were cleaned up. The network and npm subprocess guards were self-tested; the default-update control additionally demonstrated that npm invocation is detected.

The downloadable fixtures contain a real Node runtime and a small version-reporting CLI. This verifies download, checksum, version smoke testing, replacement, backup retention and failure preservation; it does not claim acceptance of a complete new release or Windows deferred replacement. No real installation was changed.

Additional validation: full build, workspace typecheck, bundle, 170 focused unit tests, changed-file ESLint and Prettier passed. Independent static review found no actionable code defects.

---

独立 E2E 11/11 通过：指定版本结合自定义 HTTPS 地址、同版本重装、降级和 preview 安装成功；包内版本不符或 checksum 不符时保留原安装；非法标签、路径、范围及缺少参数在下载前拒绝。所有显式版本用例均为零 npm 子进程、零 registry 请求；不指定版本的对照仍尝试 npm 查询，被测试 guard 正确捕获。TLS 校验开启，锁及临时文件已清理。

验证使用真实新版 CLI bundle、真实 Node 和精简版本输出制品，覆盖升级流程而非完整新版本功能验收；未修改真实安装，未验证 Windows 延迟替换。另有完整构建、工作区类型检查、bundle、170 项单测及静态检查通过，独立静态审查未发现可操作的代码缺陷。