fix(auto-update): treat only explicit semver pins as user-pinned

Fixes #1920

Installer-written exact versions (e.g., oh-my-opencode@3.5.2) were incorrectly treated as user-pinned, blocking auto-updates for all installer users.

Fix isPinned to only block auto-update when pinnedVersion is an explicit semver string (user's intent). Channel tags (latest, beta, next) and bare package name all allow auto-update.

Fix installer fallback to return bare PACKAGE_NAME for stable versions and PACKAGE_NAME@{channel} for prerelease versions, preserving channel tracking.

src/hooks/auto-update-checker/hook/background-update-check.test.ts

@@ -80,14 +80,16 @@ describe("runBackgroundUpdateCheck", () => {
       expect(mockUpdatePinnedVersion).not.toHaveBeenCalled()
     })
 
-    it("#then should show update-available toast instead", async () => {
+    it("#then should show manual-update toast message", async () => {
       await runBackgroundUpdateCheck(mockCtx, true, mockGetToastMessage)
 
-      expect(mockShowUpdateAvailableToast).toHaveBeenCalledWith(
-        mockCtx,
-        "3.5.0",
-        mockGetToastMessage
-      )
+      expect(mockShowUpdateAvailableToast).toHaveBeenCalledTimes(1)
+
+      const [toastContext, latestVersion, getToastMessage] = mockShowUpdateAvailableToast.mock.calls[0] ?? []
+      expect(toastContext).toBe(mockCtx)
+      expect(latestVersion).toBe("3.5.0")
+      expect(typeof getToastMessage).toBe("function")
+      expect(getToastMessage(true, "3.5.0")).toBe("Update available: 3.5.0 (version pinned, update manually)")
     })
 
     it("#then should NOT run bun install", async () => {