v0.1.36: print install.sh fallback when update check fails

Timeouts, transient failures, or future rate-limits now end with a
concrete recovery command rather than just an error message.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: xbtoshi

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to **kyc-cli** and **sshwap** are documented here.
 The format is loosely [Keep a Changelog](https://keepachangelog.com/);
 versioning follows [SemVer](https://semver.org/).
 
+## [0.1.36] — 2026-05-11
+
+### Changed
+- **`kyc-cli update` prints an `install.sh` fallback on check failure.**
+  Network timeouts, transient API errors, or a future rate-limit
+  surface now end with a concrete escape hatch — a one-line
+  `curl ... | sh` that hits the CDN download path directly. The
+  background nudge stays silent (we don't want to pester users on
+  flaky networks).
+
 ## [0.1.35] — 2026-05-11
 
 ### Fixed

cmd/kyc-cli/main.go

@@ -118,6 +118,12 @@ func runUpdate(args []string) {
 	tag, err := update.CheckLatest(ctx, version)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "update check failed:", err)
+		fmt.Fprintln(os.Stderr)
+		fmt.Fprintln(os.Stderr, "fallback — install the latest release directly:")
+		fmt.Fprintln(os.Stderr, "  curl -fsSL https://raw.githubusercontent.com/kyc-rip/cli/master/scripts/install.sh | sh")
+		fmt.Fprintln(os.Stderr)
+		fmt.Fprintln(os.Stderr, "or pin a specific version:")
+		fmt.Fprintln(os.Stderr, "  curl -fsSL https://raw.githubusercontent.com/kyc-rip/cli/master/scripts/install.sh | sh -s v0.1.34")
 		os.Exit(1)
 	}
 	if tag == "" {