ci(release): publish verified installer assets

[mogul]

Context

Implements #408 by moving installer distribution from a moving raw main URL to release assets that can be verified and pinned.

What changed

• Release workflow now runs release-please in manifest config mode and uploads release assets when a release is created.
• Release asset build copies install.sh, injects the exact release commit SHA into DEFAULT_RELEASE_SHA, generates SHA256SUMS, and uploads both files to the GitHub release.
• Installer defaults to the current release tag via release-please-managed DEFAULT_RELEASE_VERSION; release assets add the canonical commit SHA pin.
• README install examples now use pinned release asset URLs and document checksum verification.
• ADR-0002 and ADR-0026 document the release asset/checksum behavior.
• Added installer Bats coverage for release-tag defaults and release-asset SHA verification.
• Excluded vendored Bats submodule Markdown from npm run lint:md, since initialized third-party submodules should not be normalized by this repo.

Verification

• shellcheck --severity=warning install.sh test/bats/05-install.bats — passed.
• ./scripts/test-acq-bats test/bats/05-install.bats — passed, 2 tests.
• ./scripts/test-acq-bats — passed, 394 tests.
• npm run lint:md — passed, 0 issues.
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); YAML.load_file(".github/release.yml")' — passed.
• git diff --check — passed.
• Simulated release asset generation with SHA injection and shasum -a 256 -c SHA256SUMS — passed.

Rollback

Revert this PR. The installer will return to the previous raw main URL/default-ref behavior and release-please will stop uploading installer assets.

Security impact

Positive supply-chain impact: release downloads become checksum-verifiable, and release installer assets default clone installs to a release tag plus an exact release commit SHA check. No authn/authz runtime paths, secret handling paths, or sandbox permissions are broadened.

AI assistance

AI-assisted implementation with human review required before merge.