fix(auto-update): use USER_CONFIG_DIR instead of CACHE_DIR for plugin invalidation

The auto-update-checker was operating on the wrong directory:
- CACHE_DIR (~/.cache/opencode) was used for node_modules, package.json, and bun.lock
- But plugins are installed in USER_CONFIG_DIR (~/.config/opencode)

This caused auto-updates to fail silently:
1. Update detected correctly (3.x.x -> 3.y.y)
2. invalidatePackage() tried to delete from ~/.cache/opencode (wrong!)
3. bun install ran but respected existing lockfile
4. Old version remained installed

Fix: Use USER_CONFIG_DIR consistently for all invalidation operations.

Also moves INSTALLED_PACKAGE_JSON constant to use USER_CONFIG_DIR for consistency.

src/hooks/auto-update-checker/constants.ts

@@ -16,12 +16,6 @@ function getCacheDir(): string {
 
 export const CACHE_DIR = getCacheDir()
 export const VERSION_FILE = path.join(CACHE_DIR, "version")
-export const INSTALLED_PACKAGE_JSON = path.join(
-  CACHE_DIR,
-  "node_modules",
-  PACKAGE_NAME,
-  "package.json"
-)
 
 export function getWindowsAppdataDir(): string | null {
   if (process.platform !== "win32") return null
@@ -31,3 +25,10 @@ export function getWindowsAppdataDir(): string | null {
 export const USER_CONFIG_DIR = getOpenCodeConfigDir({ binary: "opencode" })
 export const USER_OPENCODE_CONFIG = path.join(USER_CONFIG_DIR, "opencode.json")
 export const USER_OPENCODE_CONFIG_JSONC = path.join(USER_CONFIG_DIR, "opencode.jsonc")
+
+export const INSTALLED_PACKAGE_JSON = path.join(
+  USER_CONFIG_DIR,
+  "node_modules",
+  PACKAGE_NAME,
+  "package.json"
+)