fix(check): fail when the manifest is behind the tag, not merely different

`task check` asserted plugin.json's version EQUALS the latest tag. `git
describe` is local-only, so any checkout that had not fetched the tag CI just
pushed went red on a commit that was correct — three times in one backlog
session, on the loop push → CI tags and pushes the bump → pull → red until you
also fetch tags.

The fault the assertion exists for is the manifest failing to move: a release
whose manifest still names the old version, so no installed host ever sees the
update. That is manifest < tag. Ahead is normal and is now quiet.

Ordering needed a real comparison, and bin/doctor had already grown one for
#30, so it moves to bin/newer-version with its own tests rather than existing
twice. Seven cases including the lexical trap (0.8.10 beats 0.8.9) and a
missing component counting as zero.

Verified by mutation: manifest 0.1.0 against tag v0.9.0 exits 201 naming both
versions; manifest 9.9.9 exits 0; the real tree exits 0.

Closes #34
Bump-Type: patch

tests/newer_version_test.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+# Tests for bin/newer-version.
+#
+# Extracted from bin/doctor (#30) once `task check` needed the same comparison
+# (#34): check asserted plugin.json == latest tag, which is red on any checkout
+# that has not fetched the tag the CI tagger just pushed. The assertion it
+# actually wants is "not behind", and ordering needs a real comparison.
+
+set -u
+
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+SUT="$ROOT/bin/newer-version"
+
+pass=0
+fail=0
+
+if [ ! -f "$SUT" ]; then
+  printf 'FAIL: %s does not exist\n' "$SUT"
+  exit 1
+fi
+
+# expect <winner> <a> <b> <label>
+expect() {
+  _got=$(sh "$SUT" "$2" "$3")
+  if [ "$_got" = "$1" ]; then
+    pass=$((pass + 1)); printf '  ok   %s\n' "$4"
+  else
+    fail=$((fail + 1)); printf '  FAIL %s (newer-version %s %s -> %s, want %s)\n' "$4" "$2" "$3" "$_got" "$1"
+  fi
+}
+
+expect 0.9.0  0.9.0  0.8.5  'higher minor wins, left'
+expect 0.9.0  0.8.5  0.9.0  'higher minor wins, right'
+expect 0.8.10 0.8.10 0.8.9  'numeric compare, not lexical — 10 beats 9'
+expect 1.0.0  1.0.0  0.99.99 'major dominates'
+expect 0.8.5  0.8.5  0.8.5  'equal returns the value'
+expect 0.9.1  0.9.1  0.9    'a missing component counts as zero'
+expect 0.9    0.9    0.9.0  'equal with a missing component returns the left, per contract'
+
+printf '\nnewer_version: %d passed, %d failed\n' "$pass" "$fail"
+[ "$fail" -eq 0 ]