Updater leftovers: startup path doesn't require checksums; update subcommand exit code

[andrewklingelhofer]

Found during review of #372.

1. src/daemon.ts:204 — the daemon-startup update path calls checkForUpdate(VERSION) without requireChecksum, so an unverified install is still possible there if a release ever lacks the checksum asset. (Failure there doesn't block boot; the auto-updater path correctly requires checksums.)
2. src/cli-router.ts:91 — the update subcommand still exits 0 even when the update fails; the new boolean return from checkForUpdate makes a non-zero exit trivial.
3. Operational dependency to keep in mind: auto-update now requires checksums-sha256.txt on every release (currently always uploaded by the release workflow — keep it that way).