Installer: securely install verified macOS and Linux releases

[sraodev]

Summary

New users currently have to clone and build the repository. This PR adds the reviewed installer foundation for the ubt, ubtctl, and ubtd release bundles created by #45.

• supports latest or exact-version installation on macOS/Linux AMD64 and ARM64
• detects Apple Silicon while running under Rosetta
• ignores implicit curl configuration and permits only HTTPS downloads and redirects
• verifies SHA-256, the exact archive manifest, and executable behavior before touching the destination
• installs all three executables as one set and restores the previous set after replacement failures
• adds network-free behavior and fault-injection tests on both CI operating systems

Closes #41.

Review scope

Two focused commits separate the installer/CI implementation from its checked-in review package.

The README does not advertise a curl command yet because the current public release predates the native asset contract. Release publication, a stable installer URL, mise, Homebrew, signing, Windows, daemon startup, and PATH changes remain separate gates.

Attached review documents

• Secure installer scope — included/excluded work, design references, ordered review, security invariants, failures, test evidence, rollout gates, and evidence limits.
• Installer implementation — argument/platform selection, HTTPS downloads, validation, staged execution, and replacement transaction.
• Offline installer tests — release fixtures, platform simulation, invalid inputs, integrity failures, unsafe archive types, and rollback fault injection.
• CI integration — POSIX/Bash syntax, Linux ShellCheck, and behavior tests on Linux and macOS.

Reviewer roadmap

SVG · Mermaid source

Sequence diagram — selection, verification, replacement, and rollback

SVG · Mermaid source

Architecture diagram — network trust boundary, validation, and target transaction

SVG · Mermaid source

Verification

Passed locally on macOS/ARM64:

sh -n scripts/install.sh
bash -n scripts/install.sh
shellcheck scripts/install.sh
python3 -m unittest scripts/test_install.py -v
gofmt -l .
go vet ./...
go test -race ./...
go build ./...
python3 scripts/smoke.py
python3 -m unittest discover -s examples/chat -p 'test_*.py' -v
git diff --check

All 14 installer scenarios pass. The three Mermaid sources passed the pinned Mermaid 11.12.0 renderer, and their PNG renders were visually inspected. Workflow YAML parsed successfully.

An additional legacy Python SDK pytest attempt remains unable to collect on this host because the optional PyBluez bluetooth module is absent. That suite is not part of current CI, and this PR does not change the legacy Python SDK.

Important limits and remaining gates

This PR does not prove public installation because no compatible native-asset release has been published after #45. After merge, a maintainer must approve a tag, inspect the release assets, and run exact-version installs on the four native OS/architecture targets before adding the README command.

Shell rollback handles ordinary command failures and handled signals; it cannot guarantee recovery after SIGKILL, power loss, or concurrent installers. The release binaries are not signed, notarized, attested, or accompanied by an SBOM. The canonical stable endpoint remains issue #44; mise and Homebrew remain #42 and #43.