fix(cli): Compare prerelease identifiers in ASCII order per SemVer 2.0.0

SemVer 2.0.0 §11 requires lexical comparison of prerelease identifiers in
ASCII sort order. The previous implementation used String.prototype.localeCompare,
which applies locale-dependent collation and can differ from ASCII ordering.
For example, "Alpha".localeCompare("alpha") returns 1 in common locales while
ASCII comparison returns -1.

Replace localeCompare with a UTF-16 code-unit comparison, which matches
ASCII ordering for the [0-9A-Za-z-] character set SemVer permits.

Reported in PR review by Cursor Bugbot.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: cameroncooke

src/cli/commands/__tests__/upgrade.test.ts

@@ -301,6 +301,15 @@ describe('upgrade command', () => {
       ).toBe('older');
     });
 
+    it('compares prerelease identifiers in ASCII order (uppercase before lowercase)', () => {
+      expect(
+        compareVersions(
+          { major: 1, minor: 0, patch: 0, prerelease: 'Alpha' },
+          { major: 1, minor: 0, patch: 0, prerelease: 'alpha' },
+        ),
+      ).toBe('older');
+    });
+
     it('numeric prerelease identifier is less than string identifier', () => {
       expect(
         compareVersions(

src/cli/commands/upgrade.ts

@@ -100,7 +100,7 @@ function comparePrereleaseIdentifiers(a: string, b: string): number {
     if (aIsNum) return -1;
     if (bIsNum) return 1;
 
-    const cmp = aParts[i].localeCompare(bParts[i]);
+    const cmp = aParts[i] < bParts[i] ? -1 : aParts[i] > bParts[i] ? 1 : 0;
     if (cmp !== 0) return cmp;
   }