Fix public installer and prove native install outcomes

[ebursztein]

Outcome

• macOS public curl installer now verifies and synchronously installs the exact manifest package with the native installer command
• Linux and macOS reject package byte-size or SHA-256 drift before elevation
• release CI installs exact macOS/Linux artifacts, checks full cohorts and readiness, and proves a PTY-driven guest shell on Linux
• post-deploy CI runs the live public Linux curl installer on native systemd/KVM and proves guest execution
• release skill and Sprinty gates require the final exact published package to be installed and shell-proven on a real Mac

Verification

• canonical just test: passed
• 1,651 main Python tests; release/build/install suites; Rust/frontend/coverage/audit; cross-compile; real VM integration; systemd Debian install and upgrade glow-up
• focused installer/release/shell acceptance: 42 passed
• public installer copies byte-identical and sh syntax clean

[codecov-commenter]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.