fix(installer): resolve releases from the public channel, not stale GitHub assets

[AlexMikhalev]

Problem

The documented install one-liner:

curl -fsSL https://raw.githubusercontent.com/terraphim/terraphim-ai/main/scripts/install.sh | bash

resolved latest from the version-less GitHub assets published under
terraphim/terraphim-ai. That release line stops at v1.21.3 and never produces
the names the current line ships, so the installer either installed a release
thirteen patches behind or failed outright. The current release, v1.21.16, is
published through downloads.terraphim.ai as version-and-target archives.

Change

Resolution is now manifest-driven. Both scripts read
<binary>/stable-v2.json from the channel, with stable.json as a
checksum-less fallback for the transitional period. GitHub Releases is no
longer consulted for resolution.

• Asset names come from the manifest, so all seven published targets resolve,
  including the architecture-specific macOS archives ahead of the universal one
• The requested version must match what the channel serves; anything else exits
  with a distinct code rather than silently substituting another version
• Downloads are verified against the manifest SHA-256, then unpacked in a
  staging directory; the destination is written only after the bytes verify and
  the archive is proved to contain the expected binary
• The previously vendored asset-name guesses and the partial GitHub scan are
  gone

Exit codes: 0 success, 1 usage, 2 manifest unreachable, 3 version
unavailable, 4 download failed, 5 checksum mismatch, 6 install failed.

scripts/SHA256SUMS pins the sibling utilities the installer fetches when it
runs under curl | bash and has no directory of its own.

Test evidence

scripts/test-installer.sh replaces the previous harness, which reported
success without asserting anything about the artefacts. It installs and runs
the real binary, and proves fail-closed behaviour by serving a manifest whose
digests are wrong while proxying the real archive bytes.

1. Static checks
  PASS  install.sh parses
  PASS  binary-resolution.sh parses
  PASS  no GitHub Releases download path
2. Manifest resolution
  PASS  resolver reports a channel version
  PASS  resolver reports a strict-manifest checksum
  PASS  unavailable version refused (exit 2)
3. Install and run
  PASS  installer exits 0
  PASS  binary is present
  PASS  installed binary reports 1.21.16
  PASS  installed binary is non-trivial
4. Fail-closed on manipulation
  PASS  live manifest fetchable
  PASS  tampered release refused (exit 5)
  PASS  nothing installed from tampered release

Results: 13 passed, 0 failed

Run it with bash scripts/test-installer.sh.

Manually exercised as well: all seven targets resolve against the live
manifests; --with-cli --with-grep, --cli-only, --version 1.21.16 and
--skip-verify each behave; a tampered manifest exits 5 with an empty install
directory; a tampered helper script is rejected before any install.

Follow-up (not in this PR)

raw.githubusercontent.com caches for several minutes, so the published
one-liner picks up this script shortly after merge. The website will set
branch=main on the raw URL to make the fix immediate, and can pin
UTILS_REVISION to a tag for reproducibility.