fix: document the pre-publish install, and three update-check bugs

[imjohnbo]

The README told people to run npm install -g @imjohnbo/kit-cli. Nothing is
published yet, so that line was false.

Install docs

The README now leads with the install that works today:

npm install -g github:imjohnbo/kit-cli

It also covers the clone-and-link path for development, and keeps the npm
instructions for once the package ships. I verified all three against a sandboxed
--prefix rather than touching a real global install.

kit upgrade cannot help before the package is published, so it now says that
outright instead of implying a network problem.

Three bugs found while checking those instructions

1. The version cache was not keyed by package name.

This package was briefly named kit-cli, which belongs to a different author on
npm at 0.0.4. Anyone who ran the CLI before the rename kept being told to upgrade
to a stranger's release, forever. My own config held exactly that:

$ kit --version
Update available: 0.0.1 -> 0.0.4. Run `kit upgrade`.
0.0.1

The cache now records which package a version came from and ignores an entry from
a different one.

2. A 404 read as a network failure.

An unpublished package produced "Could not reach the registry", which is both
wrong and unhelpful. refreshLatest now returns { status, version }, so the
caller can tell "not published" from "cannot reach". kit upgrade says which.

3. kit upgrade did nothing for anyone who had turned the notice off.

The preference is about unattended requests, not about a command the user just
typed. An explicit upgrade now skips the preference check.

One less hardcoded string

REPOSITORY joins VERSION and PACKAGE_NAME in src/package-info.js, parsed
from the repository URL, so the GitHub install hint is not another literal. A test
asserts upgrade.js does not hardcode the slug.

Review notes

Stacked on #26

This now sits on top of #26, which adds the subscriber location commands and
fixes the [skip ci] gap that let main go red unnoticed. Merge #26 first.

Tests: 560 on #26, 571 with this.