install: curl-installer for the release binary (#64)

[Flocqst]

Summary

• scripts/install.sh: POSIX sh installer for the prebuilt Rust client. Detects OS/arch, resolves the latest tag from the release redirect (or SHADE_TREE_VERSION), downloads the asset and its
  .sha256, verifies digest and file name, then installs to ~/.local/bin through an exclusive staging file. No sudo, https only, refuses to replace a symlink destination unless SHADE_TREE_FORCE=1.
  SHADE_TREE_LIVE=1 picks the -live variant where published.
• scripts/install.selftest.mjs: 165 offline checks against a fake file:// release: all 7 targets by detection and by override, the 3 live targets, tampered/mismatched/missing .sha256 fail
  closed, destination preflight, latest via a loopback server, error classification.
• Docs: README one-liner, rust/INSTALL.md "One-line install", docs/CONFIG.md entry.

Names follow the current repo (shade-tree, SHADE_TREE_*); the issue predates the rename. The README line sits after the agent shade-tree run block, the equivalent of the rgoe try block the
issue mentions.

Verification

• node scripts/install.selftest.mjs: 165/165
• npm test (Node 20): 106/106 node selftests, forge 124/124; fast lane 100/100
• npm run lint, sh -n, dash -n, git diff --check: clean
• Real release: latest and pinned v0.3.0, default and -live, on aarch64-apple-darwin

Closes #64