feat: add curl | sh install script

- install.sh: POSIX sh installer that detects OS/arch (incl. Rosetta),
  resolves the newest vX.Y.Z release via the GitHub API (skipping
  ownership-snapshot-current), verifies SHA256SUMS, sanity-runs the
  binary, and installs atomically into ~/.local/bin without sudo.
  Supports --version/--dir and IDX_* env overrides; prints a PATH
  hint, a NixOS flake suggestion, and helper-tool install hints
  instead of calling package managers.
- scripts/install-sh-test.sh: fixture tests against a local fake
  release server (latest, pinned, piped, checksum mismatch, missing
  release, unsupported OS, PATH hint, reinstall).
- ci.yml: install-script job (ShellCheck, sh + dash on Linux, sh on
  macOS).
- release.yml: attach install.sh to each release.
- README + docs/INSTALL.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

.github/workflows/ci.yml

@@ -56,3 +56,27 @@ jobs:
 
       - name: Run default app
         run: nix run .#default -- version
+
+  install-script:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: ShellCheck
+        if: runner.os == 'Linux'
+        run: |
+          shellcheck -s sh install.sh
+          shellcheck scripts/install-sh-test.sh
+
+      - name: Test install.sh with sh
+        run: scripts/install-sh-test.sh
+
+      - name: Test install.sh with dash
+        if: runner.os == 'Linux'
+        run: INSTALL_SH_SHELL=dash scripts/install-sh-test.sh

.github/workflows/release.yml

@@ -16,6 +16,7 @@ on:
       - "Cargo.lock"
       - "package.json"
       - "scripts/install.js"
+      - "install.sh"
 
 permissions:
   contents: write
@@ -88,6 +89,14 @@ jobs:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
+      - name: Check out install script
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
+          sparse-checkout: install.sh
+          sparse-checkout-cone-mode: false
+          path: src
+
       - name: Download target artifacts
         uses: actions/download-artifact@v4
         with:
@@ -107,3 +116,4 @@ jobs:
             idx-darwin-arm64
             idx-darwin-x64
             SHA256SUMS
+            src/install.sh