fix(check): fail when the manifest is behind the tag, not merely different

`task check` asserted plugin.json's version EQUALS the latest tag. `git
describe` is local-only, so any checkout that had not fetched the tag CI just
pushed went red on a commit that was correct — three times in one backlog
session, on the loop push → CI tags and pushes the bump → pull → red until you
also fetch tags.

The fault the assertion exists for is the manifest failing to move: a release
whose manifest still names the old version, so no installed host ever sees the
update. That is manifest < tag. Ahead is normal and is now quiet.

Ordering needed a real comparison, and bin/doctor had already grown one for
#30, so it moves to bin/newer-version with its own tests rather than existing
twice. Seven cases including the lexical trap (0.8.10 beats 0.8.9) and a
missing component counting as zero.

Verified by mutation: manifest 0.1.0 against tag v0.9.0 exits 201 naming both
versions; manifest 9.9.9 exits 0; the real tree exits 0.

Closes #34
Bump-Type: patch

bin/doctor

@@ -252,16 +252,10 @@ manifest_version() {
 }
 
 # newer_version a b — echoes whichever sorts higher on major.minor.patch.
+# Lives in bin/newer-version because `task check` needs the same ordering (#34)
+# and a second copy is a second thing to get wrong.
 newer_version() {
-  printf '%s\n%s\n' "$1" "$2" | awk -F. '
-    { raw[NR] = $0; for (i = 1; i <= 3; i++) n[NR, i] = ($i == "" ? 0 : $i + 0) }
-    END {
-      for (i = 1; i <= 3; i++) {
-        if (n[1, i] > n[2, i]) { print raw[1]; exit }
-        if (n[1, i] < n[2, i]) { print raw[2]; exit }
-      }
-      print raw[1]
-    }'
+  sh "$SELF_DIR/newer-version" "$1" "$2"
 }
 
 installed_v=''

bin/newer-version

@@ -0,0 +1,26 @@
+#!/bin/sh
+# newer-version A B — echo whichever of two dotted versions sorts higher.
+# Equal versions echo A. Missing components count as zero, so 0.9 == 0.9.0.
+#
+# Exists because two callers need ordering rather than equality:
+#   - bin/doctor, comparing the installed plugin generation against the newest
+#     manifest on the host (#30);
+#   - task check, which must fail when plugin.json is BEHIND the latest tag and
+#     stay quiet when it is ahead — the normal state on a checkout that has not
+#     fetched the tag CI just pushed (#34).
+#
+# sort -V would do it in one line and is not portable enough for this fleet.
+
+set -u
+
+[ $# -eq 2 ] || { echo "usage: newer-version A B" >&2; exit 2; }
+
+printf '%s\n%s\n' "$1" "$2" | awk -F. '
+  { raw[NR] = $0; for (i = 1; i <= 3; i++) n[NR, i] = ($i == "" ? 0 : $i + 0) }
+  END {
+    for (i = 1; i <= 3; i++) {
+      if (n[1, i] > n[2, i]) { print raw[1]; exit }
+      if (n[1, i] < n[2, i]) { print raw[2]; exit }
+    }
+    print raw[1]
+  }'