ci: enforce installer consumer synchronization

[ss-o]

Summary

• rewrite the src README with the organization template and keep the setup snippet short
• install the canonical zi-install skill from merged organization commit c26699d42c1bb9152fc2a4f92d1872fec2430166
• link the landing page to the canonical wiki installation guide
• add a versioned installer contract, impact detector, evidence auditor, tests, and scheduled audit
• require future installer changes to refresh internal consumers and immutable external evidence
• narrow workflow permissions and fix quoted GitHub output handling

Coordinated consumers

• docs: update Zi installation contract wiki#923 merged to main as 2270e295dfa7a87f773009c374f76de61aa54e24
• feat(routing): align guided setup architecture and skill .github#649 merged to main as c26699d42c1bb9152fc2a4f92d1872fec2430166
• docs: clarify official installer setup zi#568 merged to next as 3e331cf715474b9066f1ff835b01e67035a38c15

Wiki and organization evidence are published and verified against their default branches. Zi evidence remains explicitly pending until next is promoted to main; the immutable integration commit is recorded without claiming default-branch publication.

Validation

• 45 installer checks
• POSIX syntax and ShellCheck
• 7 installer contract tests
• live installer evidence audit: 2 current, 1 pending
• trusted detector archive simulation
• actionlint and changed-file Trunk checks
• checksum generation idempotence
• Linux, macOS, and both Cygwin hosted installer workflows
• CodeQL and Cloudflare Pages
• git diff --check

Refs #208 and #221.

[cloudflare-workers-and-pages]

Deploying src with    Cloudflare Pages

Latest commit:	fb1142b
Status:	✅  Deploy successful!
Preview URL:	https://83cc8f51.zi-src.pages.dev
Branch Preview URL:	https://feature-208.zi-src.pages.dev

View logs