Avoid importing urllib3 on cli50 startup

[Copilot]

cli50 was importing requests on startup solely to check PyPI for newer releases, which pulled in urllib3 and surfaced LibreSSL/OpenSSL warnings on macOS. This change removes that startup dependency while preserving the existing update-check behavior.

• Startup dependency cleanup

  • Replaced the PyPI version check’s requests call with the standard library (urllib.request + json).
  • Removed requests from install_requires, so cli50 no longer brings in urllib3 for this code path.

• Update check behavior

  • Kept the release lookup optional and non-fatal.
  • Added an explicit network timeout so startup cannot hang on a slow PyPI response.
  • Switched version comparison to semantic parsing instead of string comparison.

• Docker image refresh path

  • Preserved the existing docker pull fallback for command/execution failures during manifest inspection.
  • Avoided masking malformed manifest content as a recoverable fallback case.

Example of the startup-path change:

def pypi_releases():
    with urllib.request.urlopen("https://pypi.org/pypi/cli50/json", timeout=10) as response:
        return json.loads(response.read().decode("utf-8"))["releases"]

• Fixes On, at least, macOS 26.6.2 cli50 shows this warning on execution #121