fix(auto-update): use USER_CONFIG_DIR instead of CACHE_DIR for plugin invalidation

The auto-update-checker was operating on the wrong directory:
- CACHE_DIR (~/.cache/opencode) was used for node_modules, package.json, and bun.lock
- But plugins are installed in USER_CONFIG_DIR (~/.config/opencode)

This caused auto-updates to fail silently:
1. Update detected correctly (3.x.x -> 3.y.y)
2. invalidatePackage() tried to delete from ~/.cache/opencode (wrong!)
3. bun install ran but respected existing lockfile
4. Old version remained installed

Fix: Use USER_CONFIG_DIR consistently for all invalidation operations.

Also moves INSTALLED_PACKAGE_JSON constant to use USER_CONFIG_DIR for consistency.

src/hooks/auto-update-checker/cache.ts

@@ -1,6 +1,6 @@
 import * as fs from "node:fs"
 import * as path from "node:path"
-import { CACHE_DIR, PACKAGE_NAME } from "./constants"
+import { PACKAGE_NAME, USER_CONFIG_DIR } from "./constants"
 import { log } from "../../shared/logger"
 
 interface BunLockfile {
@@ -17,7 +17,7 @@ function stripTrailingCommas(json: string): string {
 }
 
 function removeFromBunLock(packageName: string): boolean {
-  const lockPath = path.join(CACHE_DIR, "bun.lock")
+  const lockPath = path.join(USER_CONFIG_DIR, "bun.lock")
   if (!fs.existsSync(lockPath)) return false
 
   try {
@@ -48,8 +48,8 @@ function removeFromBunLock(packageName: string): boolean {
 
 export function invalidatePackage(packageName: string = PACKAGE_NAME): boolean {
   try {
-    const pkgDir = path.join(CACHE_DIR, "node_modules", packageName)
-    const pkgJsonPath = path.join(CACHE_DIR, "package.json")
+    const pkgDir = path.join(USER_CONFIG_DIR, "node_modules", packageName)
+    const pkgJsonPath = path.join(USER_CONFIG_DIR, "package.json")
 
     let packageRemoved = false
     let dependencyRemoved = false