cli,doctor: --version flag + CLI/install drift check

Two pre-release polish items on the version-display surface.

  * --version on both binaries: cobra's Version field on the banger
    and bangerd roots renders a one-line summary (banger v0.1.0
    (commit abcd1234, built 2026-04-28T20:45:50Z)). The
    SetVersionTemplate override drops cobra's "{{.Name}} version"
    prefix — our string is already a complete sentence. The
    multi-line `banger version` subcommand is unchanged for callers
    that want the full SHA / built_at on separate lines.
  * Doctor "banger version" row: prints the running CLI's version +
    short commit + built-at, plus what /etc/banger/install.toml
    recorded at install time. Disagreement is the most common
    version-skew pitfall (stale CLI against fresh daemon, or vice
    versa) and a one-line warn is friendlier than tracking that down
    from a launch failure.
    Drift detection is suppressed when either side is dev/unknown
    (untagged build) — comparing a dev CLI against a tagged install
    is the developer-machine case, not a real problem.

formatVersionLine is in internal/cli (banger.go) and reused by
bangerd.go via a strings.Replace because bangerd's version line
should say "bangerd" not "banger". Slightly tilt-feeling but cheaper
than parameterising the helper for one caller.

Tests: TestVersionsDriftToleratesDevAndUnknown pins the four
branches (match, version diff, commit diff, dev-suppression). The
existing version-format test already runs through formatVersionLine
indirectly.

Live exercise:
  $ banger --version
  banger dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)
  $ bangerd --version
  bangerd dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)
  $ banger doctor | head
  ...
  PASS	banger version
    - CLI dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/doctor.go

@@ -9,6 +9,9 @@ import (
 	"strings"
 	"syscall"
 
+	"time"
+
+	"banger/internal/buildinfo"
 	"banger/internal/config"
 	"banger/internal/firecracker"
 	"banger/internal/imagecat"
@@ -72,6 +75,7 @@ func (d *Daemon) doctorReport(ctx context.Context, storeErr error, storeMissing
 	report := system.Report{}
 
 	addArchitectureCheck(&report)
+	addBangerVersionCheck(&report, installmeta.DefaultPath)
 
 	switch {
 	case storeMissing:
@@ -439,6 +443,60 @@ func (d *Daemon) addSSHShortcutCheck(report *system.Report) {
 	)
 }
 
+// addBangerVersionCheck reports the running CLI's version + commit
+// alongside whatever's recorded in /etc/banger/install.toml. When
+// the installed copy and the running binary disagree on version or
+// commit, doctor warns: a stale `banger` running against a freshly-
+// installed daemon (or vice versa) is the most common version-skew
+// pitfall, and a one-line warning is friendlier than tracking down
+// which side is wrong from a launch failure.
+//
+// Drift detection is suppressed when EITHER side is "dev"/"unknown"
+// (untagged build) — those don't have a real version to compare.
+func addBangerVersionCheck(report *system.Report, installPath string) {
+	cli := buildinfo.Current()
+	cliLine := fmt.Sprintf("CLI %s (commit %s, built %s)", cli.Version, shortCommit(cli.Commit), cli.BuiltAt)
+
+	meta, err := installmeta.Load(installPath)
+	if err != nil {
+		// Non-system mode (no install.toml). Just report what we have.
+		report.AddPass("banger version", cliLine)
+		return
+	}
+	installLine := fmt.Sprintf("install %s (commit %s, installed %s)", meta.Version, shortCommit(meta.Commit), meta.InstalledAt.Format(time.RFC3339))
+	if versionsDrift(cli, meta) {
+		report.AddWarn("banger version",
+			cliLine,
+			installLine,
+			"CLI and installed banger disagree; run `sudo banger system install` to refresh, or run the matching CLI binary")
+		return
+	}
+	report.AddPass("banger version", cliLine, installLine+" (matches CLI)")
+}
+
+func versionsDrift(cli buildinfo.Info, meta installmeta.Metadata) bool {
+	// Treat dev/unknown as "no real version on this side" — comparing
+	// a dev build against a tagged install is the local-development
+	// case, not a drift problem worth surfacing.
+	if cli.Version == "dev" || strings.TrimSpace(meta.Version) == "" {
+		return false
+	}
+	if cli.Version != meta.Version {
+		return true
+	}
+	if cli.Commit != "unknown" && strings.TrimSpace(meta.Commit) != "" && cli.Commit != meta.Commit {
+		return true
+	}
+	return false
+}
+
+func shortCommit(c string) string {
+	if len(c) > 8 {
+		return c[:8]
+	}
+	return c
+}
+
 // addArchitectureCheck surfaces a hard-fail when banger is running on
 // a non-amd64 host. Companion binaries are pinned to amd64 in the
 // Makefile, the published kernel catalog ships only x86_64 images, and