Missing .version can mark an old installation as current without updating it #12

Bug

In src/bot/autoUpdate.ts, when currentVersion(root) returns an empty string, the updater fetches the latest commit SHA and writes that SHA directly to .version:

if (have === "") {
  fs.writeFileSync(stampFile(root), sha);
  return { kind: "current", text: "" };
}

No update is applied in this path.

User effect

An old/copied installation that has no .version can be stamped with the latest SHA while still containing old files. Future checks then report it as current.

Expected

A missing/invalid version stamp must not prove that the working files equal HEAD.

Possible fixes:

• package every official build with a reliable version stamp; and
• if the stamp is missing, perform a full update/verification instead of writing HEAD directly.

Test

Take an old installation, delete .version, then run update check against a newer HEAD. It must not end up reporting current without actually updating the files.