Replace update-notifier with a zero-dependency equivalent (removes 23 packages) #8368

Which problem is this feature request solving?

update-notifier pulls 23 packages into the CLI's dependency tree purely to check whether a newer version has been published. For a tool installed as widely as this one, that is 23 more packages to resolve, audit and trust, in service of one request to the registry and a box drawn on stderr.

Describe the solution you'd like

Replace it with nano-update-notifier, which implements the same public API — same options, same notifier.update shape, same suppression rules — on Node.js built-ins alone, with no runtime dependencies. Types ship with the package, so @types/update-notifier can go as well.

I have the change prepared and verified against main:

• One import in bin/run.js, two entries in package.json.
• 23 packages removed from the lockfile, 1 added: @pnpm/config.env-replace, @pnpm/network.ca-file, @pnpm/npm-conf, @types/configstore, @types/update-notifier, config-chain, configstore, deep-extend, escape-goat, global-directory, is-in-ci, is-installed-globally, is-npm, ky, latest-version, package-json, proto-list, pupa, rc, registry-auth-token, registry-url, update-notifier, xdg-basedir.
• npm run test:unit passes 423/423, identical to the same run on main including the 5 pre-existing errors from exec-fetcher downloads.
• build, typecheck, lint and format:check are all clean.
• The rendered notification is unchanged. I captured the full output of bin/run.js with a seeded update under both libraries and diffed it: byte for byte identical, including the ⬥ title, the OSC 8 hyperlink on "release notes", the inverse truecolour install command, and the #28b5ac border.

Compatibility is held by differential test suites that run update-notifier, boxen, semver and string-width as oracles: the full box option matrix, the notification rendering with colour enabled, and fuzzed version comparison. The package is published from a GitHub Actions release with provenance.

The branch is ready at HeversonSilva-gif/cli:deps/nano-update-notifier if you would like to see the diff.

Two things worth raising before any pull request:

• .kodiak.toml shows dependencies here are managed by Renovate. A hand-swapped dependency sits outside that flow, and I don't know whether you would want Renovate taught about the replacement.
• Disclosure: I wrote nano-update-notifier. That is exactly why I am opening an issue rather than dropping a pull request on you — CONTRIBUTING asks for discussion first, and a proposal to adopt my own package deserves it more than most. If this is not something you want to take on, saying so costs you nothing and I will not push it.