The CLI says when a newer version exists after it rejects an option

An installed withruntime stays at its version until you update it, and npx withruntime runs an installed copy before it downloads one, so an older CLI could reject an option the docs list, such as secrets scope --only-label, with no sign that it was out of date. Now, when the CLI rejects an option or a command, it checks npm for the latest version, for at most 1.5 seconds, and prints the installed and latest versions with npm install -g withruntime@latest. It skips the check in CI and when RUNTIME_NO_UPDATE_CHECK=1 is set (the CLI).