cli,doctor: --version flag + CLI/install drift check

Two pre-release polish items on the version-display surface.

  * --version on both binaries: cobra's Version field on the banger
    and bangerd roots renders a one-line summary (banger v0.1.0
    (commit abcd1234, built 2026-04-28T20:45:50Z)). The
    SetVersionTemplate override drops cobra's "{{.Name}} version"
    prefix — our string is already a complete sentence. The
    multi-line `banger version` subcommand is unchanged for callers
    that want the full SHA / built_at on separate lines.
  * Doctor "banger version" row: prints the running CLI's version +
    short commit + built-at, plus what /etc/banger/install.toml
    recorded at install time. Disagreement is the most common
    version-skew pitfall (stale CLI against fresh daemon, or vice
    versa) and a one-line warn is friendlier than tracking that down
    from a launch failure.
    Drift detection is suppressed when either side is dev/unknown
    (untagged build) — comparing a dev CLI against a tagged install
    is the developer-machine case, not a real problem.

formatVersionLine is in internal/cli (banger.go) and reused by
bangerd.go via a strings.Replace because bangerd's version line
should say "bangerd" not "banger". Slightly tilt-feeling but cheaper
than parameterising the helper for one caller.

Tests: TestVersionsDriftToleratesDevAndUnknown pins the four
branches (match, version diff, commit diff, dev-suppression). The
existing version-format test already runs through formatVersionLine
indirectly.

Live exercise:
  $ banger --version
  banger dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)
  $ bangerd --version
  bangerd dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)
  $ banger doctor | head
  ...
  PASS	banger version
    - CLI dev (commit 1c1ca7d6, built 2026-04-28T20:52:33Z)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/doctor_test.go

@@ -8,7 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	"banger/internal/buildinfo"
 	"banger/internal/firecracker"
+	"banger/internal/installmeta"
 	"banger/internal/model"
 	"banger/internal/paths"
 	"banger/internal/system"
@@ -371,6 +373,43 @@ func TestDoctorReport_MissingFirecrackerFailsFirecrackerBinaryCheck(t *testing.T
 	}
 }
 
+// TestVersionsDriftToleratesDevAndUnknown pins the suppression
+// branches: a "dev"/"unknown" build on either side is the local-
+// development case, not a drift problem; we don't want every
+// developer-machine doctor run to emit a noisy warn.
+func TestVersionsDriftToleratesDevAndUnknown(t *testing.T) {
+	t.Parallel()
+	cliReleased := buildinfo.Info{Version: "0.1.0", Commit: "abcd1234efgh", BuiltAt: "2026-04-28"}
+	metaReleased := installmeta.Metadata{Version: "0.1.0", Commit: "abcd1234efgh"}
+
+	// Match → no drift.
+	if versionsDrift(cliReleased, metaReleased) {
+		t.Fatal("identical CLI and install metadata reported as drifted")
+	}
+	// Real version mismatch → drift.
+	bumped := metaReleased
+	bumped.Version = "0.2.0"
+	if !versionsDrift(cliReleased, bumped) {
+		t.Fatal("differing version not flagged as drift")
+	}
+	// Same version, different commit → drift (rebuilt without retag).
+	differCommit := metaReleased
+	differCommit.Commit = "deadbeefdead"
+	if !versionsDrift(cliReleased, differCommit) {
+		t.Fatal("differing commit at same version not flagged as drift")
+	}
+	// "dev" CLI vs released install → suppressed.
+	devCLI := buildinfo.Info{Version: "dev", Commit: "f00fb00b", BuiltAt: "now"}
+	if versionsDrift(devCLI, metaReleased) {
+		t.Fatal("dev CLI vs released install incorrectly flagged as drift")
+	}
+	// Empty install version → suppressed (predates the field).
+	emptyMeta := installmeta.Metadata{}
+	if versionsDrift(cliReleased, emptyMeta) {
+		t.Fatal("empty install metadata incorrectly flagged as drift")
+	}
+}
+
 // TestFirecrackerInstallHintDispatchesByDistro pins the per-distro
 // install command guess. Pinned IDs are the ones banger is willing to
 // suggest a concrete command for; everything else gets only the