Fix false success message when CLI self-upgrade installs the wrong version

[craigmichaelmartin]

WHY are these changes introduced?

A user behind a private npm registry ran the CLI self-update on 4.7.0: the registry (401ing against upstream) resolved a stale latest tag, so npm install -g @shopify/cli@latest downgraded them to 3.94.3 with a zero exit code — while the CLI printed "Shopify CLI upgraded. You're now on version 4.7.1."

Root cause: runCLIUpgrade built the success banner from the cached version check (which queries the public npm registry) and trusted the install's exit code, but the install resolves through whatever registry the user's npm config points at. The two can disagree, and the exit code alone doesn't prove the right version landed.

WHAT is this pull request doing?

In packages/cli-kit/src/public/node/upgrade.ts, after the package-manager install completes, verify what was actually installed using the existing globalCLIVersion() helper (runs the installed shopify binary and parses its version):

• If the installed version is older than expected (the cached newer version, or the current version when none was cached), throw an AbortError naming both versions, with a hint that the package manager may be resolving @shopify/cli from a registry with outdated versions.
• If the version can't be determined, throw an AbortError suggesting shopify version.
• On success, the banner reports the verified installed version instead of the cached prediction.

The auto-upgrade postrun hook already catches errors from runCLIUpgrade, so a failed background upgrade now logs, shows the upgrade reminder, records env_auto_upgrade_success: false, and reports to Bugsnag instead of silently claiming success.

Minor wording change: shopify upgrade when already up to date now says "You're now on version X." (the verified version) instead of "You're now on the latest version."

How to test your changes?

1. Unit tests: pnpm vitest run src/public/node/upgrade.test.ts in packages/cli-kit (new cases cover the downgrade, same-version, unverifiable, and verified-success paths).
2. Manually: with a global install, run shopify upgrade normally — the success banner should show the actual installed version. To simulate the failure, point npm at a registry serving an older @shopify/cli (npm config set registry ...) and run shopify upgrade — it should abort with "Failed to upgrade Shopify CLI. Expected to be on version X, but version Y is now installed." instead of a success banner.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

🤖 Generated with Claude Code