feat(sync): stop when upstream needs a newer CLI

[flipvh]

A sync bumps the app's @cellajs/cli along with its other packages, so every sync runs on the CLI from before it. Any fix to analyze or sync therefore reaches an app one sync late.

This already happened: projectcampus synced to cella 2fb4512b5 on 0.2.2. That run did not report the new backend/src/bundle-config.ts pin or the ignored-path changes, both of which #27 added in 0.2.3. Upstream's package.json already required ^0.2.3.

Change

analyze and sync read the @cellajs/cli range from upstream's root package.json at the target ref. If the running CLI is below that range's lower bound, the run stops before anything merges:

✓ remote configured
  cella-upstream/main → git@github.com:cellajs/cella.git
✗ upstream needs @cellajs/cli ^0.2.3, this is 0.2.2: an older CLI misses fixes to the sync itself.
  update it, commit, then rerun: pnpm add -D -w '@cellajs/cli@^0.2.3'

• Ranges with no lower bound never block: workspace:, link:, file:, *, <x, >x and a || b. A locally linked CLI keeps working.
• When upstream names no CLI, or its package.json is missing or unparsable, nothing is checked.
• parseComparableVersion and compareVersions move unchanged from services/packages.ts to utils/versions.ts, so both callers share them.

Verification

• tests/cli-version.test.ts: 5 new tests. 210 of 210 tests pass, along with tsgo and Biome.
• Ran from source on a clone of projectcampus main from before its sync (279003742):
  • With the version set to 0.2.2, it stops as shown above, with exit code 1.
  • With 0.2.3, the analysis completes and reports + pinned: backend/src/bundle-config.ts.

🤖 Generated with Claude Code