Warn about flagged and outdated versions at runtime

[tsalo]

Summary

Ports fMRIPrep's version-check infrastructure (nipreps/fmriprep#1715) to QSIRecon.

• Flagged versions. A new .versions.json at the repository root maps release versions to the reason they were flagged. At startup, _build_parser fetches that file from main and prints fMRIPrep's FLAGGED banner to stderr if the running version appears in it. The file starts with 1.2.0 and 26.0.0, flagged for the template-space .mif parcellation bug (Connectivity .mif parcellations are in template space, not DWI space #399), matching the "Major bugs affecting this version" sections of the changelog.
• Newer releases. check_latest() (present since the rename from QSIPrep but never called, and pointed at PyPI, where QSIRecon is not published) now queries the Docker Hub tags API and prints the "newer version available" banner. Docker Hub is where releases are distributed, and its unauthenticated rate limit (180 per window, per IP) is far more forgiving than GitHub's 60/hour for clusters behind a shared NAT. Results are cached in ~/.cache/qsirecon/latest for 14 days.
• Robustness. Unlike fMRIPrep, response parsing is inside the try, so a captive portal, rate-limit body, malformed .versions.json, or odd tag name (latest, unstable) can never stop a run.
• Docs. New "When should I upgrade?" section in installation.rst, adapted from fMRIPrep's FAQ; the banners link to it.
• requests is now a declared dependency (it was only installed transitively). pixi.lock is left for the lockfile workflow.

Note that 26.0.1 was tagged without these checks, so releases up to and including 26.0.1 will not print a warning even if they are listed in .versions.json. The docs say so.

Test plan

• New qsirecon/tests/test_version.py and qsirecon/tests/test_parser.py (37 tests, ported from fMRIPrep plus cases for non-JSON, rate-limit, and non-version-tag responses) pass locally
• Built the real parser against the live Docker Hub API with an empty cache: 26.0.0 prints the upgrade banner naming 26.0.1; 26.0.1 and a dev build print nothing
• Built the real parser against a locally served .versions.json: 26.0.0 prints the FLAGGED banner; a non-JSON response is ignored
• Docs build

Related PRs

The same change in the other PennLINC BIDS Apps:

• Warn users about newer releases and flagged versions qsiprep#1188: QSIPrep, Docker Hub tags plus .versions.json flagging
• Check Docker Hub for the latest XCP-D release xcp_d#1639: XCP-D, Docker Hub tags
• Check for new releases against Docker Hub tags instead of PyPI aslprep#733: ASLPrep, Docker Hub tags

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.43%. Comparing base (0777c49) to head (a3cb5ee).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #407      +/-   ##
==========================================
+ Coverage   50.69%   51.43%   +0.73%     
==========================================
  Files          55       55              
  Lines        8109     8125      +16     
  Branches      944      947       +3     
==========================================
+ Hits         4111     4179      +68     
+ Misses       3756     3704      -52     
  Partials      242      242              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.