feat(update): show notification after any command

- Move PrintUpdateNotification() to PersistentPostRun (runs after all commands)
- Add 100ms timeout for cached results (imperceptible but allows disk reads)
- Remove individual calls from scan_repo.go and scan_image.go

This aligns with gh CLI behavior - update notifications appear after any
command, not just scans. First run populates cache, subsequent runs show
notification instantly from cache.

Author: yiftach-armis

internal/cmd/root.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"time"
 
 	"github.com/ArmisSecurity/armis-cli/internal/auth"
 	"github.com/ArmisSecurity/armis-cli/internal/cli"
@@ -71,6 +72,10 @@ var rootCmd = &cobra.Command{
 	Version:       version,
 	SilenceUsage:  true,
 	SilenceErrors: true,
+	PersistentPostRun: func(cmd *cobra.Command, args []string) {
+		// Show update notification after any command completes (like gh CLI)
+		PrintUpdateNotification()
+	},
 	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
 		// Initialize colors based on --color flag
 		mode := cli.ColorMode(colorFlag)
@@ -176,14 +181,16 @@ func PrintUpdateNotification() {
 		return
 	}
 
-	// Non-blocking read: only show if result is already available
+	// Wait briefly for cached results (100ms is imperceptible but enough for disk reads).
+	// Fresh network requests (10s timeout) won't complete in time -- that's fine,
+	// the notification will show on the next run once the cache is populated.
 	select {
 	case result, ok := <-updateResultCh:
 		if ok && result != nil {
 			msg := update.FormatNotification(result.CurrentVersion, result.LatestVersion, output.IconDependency)
 			fmt.Fprint(os.Stderr, msg)
 		}
-	default:
+	case <-time.After(100 * time.Millisecond):
 		// Check hasn't completed yet -- silently skip
 	}
 }

internal/cmd/root_test.go

@@ -579,14 +579,14 @@ func TestPrintUpdateNotification(t *testing.T) {
 		PrintUpdateNotification()
 	})
 
-	t.Run("empty channel does not block", func(t *testing.T) {
+	t.Run("empty channel times out gracefully", func(t *testing.T) {
 		originalUpdateResultCh := updateResultCh
 		defer func() { updateResultCh = originalUpdateResultCh }()
 
 		// Create an unbuffered channel with no value
 		updateResultCh = make(chan *update.CheckResult)
 
-		// Should return immediately without blocking
+		// Should return after ~100ms timeout (not block indefinitely)
 		done := make(chan bool, 1)
 		go func() {
 			PrintUpdateNotification()
@@ -595,9 +595,9 @@ func TestPrintUpdateNotification(t *testing.T) {
 
 		select {
 		case <-done:
-			// Success - function returned
-		case <-time.After(100 * time.Millisecond):
-			t.Error("PrintUpdateNotification blocked on empty channel")
+			// Success - function returned after timeout
+		case <-time.After(200 * time.Millisecond):
+			t.Error("PrintUpdateNotification blocked indefinitely on empty channel")
 		}
 	})
 }

internal/cmd/scan_image.go

@@ -138,7 +138,6 @@ var scanImageCmd = &cobra.Command{
 			return fmt.Errorf("failed to format output: %w", err)
 		}
 
-		PrintUpdateNotification()
 		output.ExitIfNeeded(result, failOnSeverities, exitCode)
 		return nil
 	},

internal/cmd/scan_repo.go

@@ -126,7 +126,6 @@ var scanRepoCmd = &cobra.Command{
 			return fmt.Errorf("failed to format output: %w", err)
 		}
 
-		PrintUpdateNotification()
 		output.ExitIfNeeded(result, failOnSeverities, exitCode)
 		return nil
 	},