Source builds show update prompts because version is treated as upgradeable

Summary

When Codex is run from a source build, the binary version can be 0.0.0. The update-check path treats that as a normal released version, so startup and popup update prompts may appear even though there is no upgrade path from a source build.

Expected behavior

If the running version is a source-build sentinel like 0.0.0, Codex should skip the update prompt logic entirely.

Actual behavior

Codex still evaluates update availability and may show an upgrade prompt.

Reproduction

1. Build or run Codex from source so the runtime version resolves to 0.0.0.
2. Leave update checks enabled.
3. Start the TUI or trigger the popup update path.
4. Observe that Codex can report a newer version and prompt for upgrade.

Suspected root cause

The update-check entry points compare versions without first treating 0.0.0 as a non-released source build. The guard likely belongs in the shared update-path helpers so both startup checks and popup checks short-circuit consistently.

Affected area

codex-rs/tui/src/updates.rs