Refresh the CLI on upgrade, even when the release is current

`tron upgrade` gates everything on the release version, but the CLI does not come
from the release: it is written from a heredoc in install.sh, which deploys from
main on merge. Those are two different update paths, and only one of them was
being checked.

So a CLI-only change could never reach anyone. `tron store` was added, merged and
deployed, and `tron upgrade` still answered "TronBrowser is already up to date
(v3.16.1)" and left the old CLI in place -- the new command simply did not exist
on the machine, and `tron store login` fell through to the handler that opens a
URL, so it silently launched a browser instead. The only way through was
TB_FORCE=1, which nobody would think to run for a command they had just been
told exists.

The up-to-date branch already refreshes the engine, the browser, Tor, certutil,
the Moshpit root, Obscura and the macOS icon for exactly this reason: those are
current-at-fetch-time, not current-at-release-time. The CLI belongs in that list
and was missing from it. We are already executing the freshly fetched install.sh
at that point, so rewriting it costs nothing and is always current.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

apps/web/public/install.sh

@@ -1242,6 +1242,14 @@ do_upgrade() {
   [ -n "$latest" ] || err "could not resolve the latest release of $REPO"
   if [ "$current" = "$latest" ] && [ "${TB_FORCE:-0}" != "1" ]; then
     info "TronBrowser is already up to date ($current)."
+    # The CLI does NOT come from the release — it is written from a heredoc in
+    # this script, which deploys from main on merge. Gating it on the release
+    # version meant a CLI-only change could never reach anyone: `tron store` was
+    # added, deployed, and `tron upgrade` still said "already up to date" and
+    # left the old CLI in place, so the new command simply did not exist. We are
+    # already running the freshly fetched install.sh here, so rewriting it is
+    # free and always current.
+    write_cli
     ensure_engine   || true   # and that TronBrowser's own engine is current
     ensure_browser            # still make sure Ungoogled Chromium is installed
     ensure_tor      || true   # and that Tor is available for the toggle