[EPIC] E: Proactive Capability Surfacing & Updates

## Problem / User Value

Developers accumulate stale tools without realizing it — they don't proactively check for updates. Without non-intrusive surfacing, tools go months without updates, missing security patches and new features. Proactive notifications keep developers informed without interrupting their workflow.

## Definition of Done

Background update checks run on configurable interval (default 7 days). Update notifications appear as one-line banners after commands. Post-upgrade summaries show what changed (old → new version + release notes link). New-tool announcement banners display once when registry gains new entries.

## Tasks

- [ ] **E-1: Implement background update check with disk cache** (M) — Implement `ToolManager.CheckForUpdates()` as lightweight "latest versions" check per §11.4. Write results to `~/.azd/tool-updates.json` with stale-while-revalidate. Configurable interval via `azd config set tool.updateCheckInterval 7d` (default 7 days). Non-blocking: reads cache synchronously, refreshes in background goroutine.
- AC: Results cached at `~/.azd/tool-updates.json` with configurable TTL; non-blocking reads; background refresh; interval configurable via `azd config`; unit tests for cache fresh/stale/empty
- [ ] **E-2: Add update notification middleware** (M) — Create `cmd/middleware/tool_update_notify.go` per §7.2. Reads cached results from E-1, prints one-line banner after command: "Updates available for docker, az. Run `azd tool upgrade` to update." Suppressed with `--no-prompt`, `--output json`, or quiet mode. Triggers background refresh.
- AC: One-line banner after commands; suppressed in non-interactive/JSON/quiet modes; shown at most once per check cycle; background refresh triggered; unit tests for display and suppression conditions
- [ ] **E-3: Add post-upgrade summary display** (S) — Extend A-9's upgrade output to show per-tool: old → new version, and release notes URL when available in registry metadata. Add optional `releaseNotes` field to `ToolDescriptor`.
- AC: Old → new version per tool; release notes URL when available; JSON includes `releaseNotesUrl`; unit tests for formatting with/without release notes
- [ ] **E-4: Implement new-tool announcement banners** (M) — Compare current registry against previously-seen tool IDs stored in `~/.azd/tool-seen-ids.json`. Show one-time banner for new tools: "New tools available: . Run `azd tool list` to see details." Update seen list after display. Respects quiet modes.
- AC: New tool IDs detected vs seen list; one-time banner; seen list updated; quiet mode respected; unit tests for new-tool/no-new/persistence
- [ ] **E-5: Add unused tool detection heuristic** (M) — Track last detection time per tool in `~/.azd/tool-version-cache.json`. Tools not accessed in 90+ days flagged as "unused." Surface in `azd tool list` output with `(!) Unused` status. JSON includes `lastChecked` timestamp. Conservative heuristic — no false positives.
- AC: 90-day threshold; `azd tool list` shows unused indicator; JSON includes `lastChecked`; conservative heuristic; unit tests with mocked clock

## Sequencing

```
E-1 ──┬──> E-2
├──> E-4
└──> E-5
A-9 ──────> E-3
```

- **E-2, E-4, E-5** can run in parallel after E-1
- **E-3** can start as soon as A-9 exists (independent of E-1)

## Dependencies

- **Epic A (Core Engine):** A-5 (ToolManager) for E-1; A-9 (upgrade command) for E-3
- Runs after **Epics A and B/D** (Phase 3)

## Discussion Traceability

| Discussion Item | Task |
|---|---|
| F11 (surface capabilities) | E-3, E-4, E-5 |

## Design References

- `docs/design/azd-tool/plan.md` — Phase 3
- `docs/design/azd-tool-architecture.md` — §7.2 (notification middleware), §11.4 (background checks)
- `docs/design/azd-tool/todos.md` — detailed acceptance criteria