chore: notify when a newer yul release is available

[algomaster99]

Summary

• The chains-hooks marketplace source for yul is unpinned, but Claude Code doesn't re-resolve a plugin's source on every session start — it reuses whatever it last cloned into ~/.claude/plugins/cache/<marketplace>/yul/. Claude Code can auto-update a plugin in the background a few minutes after session start, but that's off by default for third-party marketplaces (only Anthropic's official ones default to on), so users can end up running a stale yul version indefinitely with no signal a newer release exists.
• ensure-yul.sh now checks GitHub's latest release tag against the plugin version resolved this session, and if newer, prints a top-level systemMessage — the same channel Claude Code's own CLI uses for its update notices, shown directly to the user's terminal, independent of whether Claude chooses to mention it. (hookSpecificOutput.additionalContext, used elsewhere for scan findings, only reaches Claude — not the user directly — so it's the wrong field for a plain "you're behind" notice.)
• The notice points at the two things that actually work: claude plugin update yul@chains-project (+ /reload-plugins or a restart) for an immediate pickup, and adding "autoUpdate": true to the chains-project entry under extraKnownMarketplaces in ~/.claude/settings.json for a durable fix. An earlier draft told users to run /plugin marketplace update chains-project, which only refreshes the marketplace catalog and does nothing to the installed plugin — corrected after testing showed it doesn't work.
• The check fails open (no curl/network/parse failure blocks startup), mirroring the rest of the script.

Before (stale version, no signal):

$ ls ~/.cache/yul/
v0.0.4/

no indication a newer release shipped.

After (stale version, one release behind):

{"systemMessage":"yul: a newer release (v0.0.5) is available; this session is running the cached v0.0.4. To pick it up now: `claude plugin update yul@chains-project`, then /reload-plugins (or restart). To stop seeing this: add \"autoUpdate\": true to the chains-project entry under extraKnownMarketplaces in ~/.claude/settings.json, so Claude Code updates it in the background automatically (this is off by default for third-party marketplaces)."}

Test plan

• go build ./... and go test ./... -v pass
• Manually ran scripts/ensure-yul.sh against the current plugin.json (already latest) — silent, exit 0
• Manually ran it against a copied plugin.json pinned to an older version — printed valid systemMessage JSON (verified with python3 -m json.tool)
• Loaded the patched plugin end-to-end via claude --plugin-dir in a scratch project with an artificially old plugin.json version — confirmed the systemMessage banner actually renders in a real session