feat: add curl | sh install script

- install.sh: POSIX sh installer that detects OS/arch (incl. Rosetta),
  resolves the newest vX.Y.Z release via the GitHub API (skipping
  ownership-snapshot-current), verifies SHA256SUMS, sanity-runs the
  binary, and installs atomically into ~/.local/bin without sudo.
  Supports --version/--dir and IDX_* env overrides; prints a PATH
  hint, a NixOS flake suggestion, and helper-tool install hints
  instead of calling package managers.
- scripts/install-sh-test.sh: fixture tests against a local fake
  release server (latest, pinned, piped, checksum mismatch, missing
  release, unsupported OS, PATH hint, reinstall).
- ci.yml: install-script job (ShellCheck, sh + dash on Linux, sh on
  macOS).
- release.yml: attach install.sh to each release.
- README + docs/INSTALL.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

.github/workflows/ci.yml

@@ -56,3 +56,27 @@ jobs:
 
       - name: Run default app
         run: nix run .#default -- version
+
+  install-script:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: ShellCheck
+        if: runner.os == 'Linux'
+        run: |
+          shellcheck -s sh install.sh
+          shellcheck scripts/install-sh-test.sh
+
+      - name: Test install.sh with sh
+        run: scripts/install-sh-test.sh
+
+      - name: Test install.sh with dash
+        if: runner.os == 'Linux'
+        run: INSTALL_SH_SHELL=dash scripts/install-sh-test.sh