Guard empty upgradeCommand args to avoid index-out-of-range panic

[morluto]

Problem

runNPMCommand indexes args[0] before validating slice length:

• if args[0] != "install" { return command.Output() }
• there is no len(args) == 0 guard.

If runNPMCommand is called with no arguments (for example, upgradeCommand(ctx, "npm")), this will panic with index out of range instead of returning an error.

Evidence

• File: internal/app/upgrade.go
• Affected path: runNPMCommand switch + post-switch check near line 53.
• Related control flow: callers in latestNPMVersion, verifyGlobalNPMVersion, and runNPMInstall currently pass validated slices, so this is currently latent but unprotected.

Impact

This is a crash vector for any future/alternate caller or tests that invoke runNPMCommand with empty input.

Suggested fix

Add an early guard before indexing args:

if len(args) == 0 {
    return nil, fmt.Errorf("missing npm arguments")
}