feat: Add a curl | bash bootstrap installer

[ruby-automation]

Closes #39.

curl -fsSL https://raw.githubusercontent.com/rubyists/sv-helper/main/bootstrap/install.sh | bash
curl -fsSL https://raw.githubusercontent.com/rubyists/sv-helper/main/bootstrap/install.sh | VERSION=v4.2.0 bash
curl -fsSL https://raw.githubusercontent.com/rubyists/sv-helper/main/bootstrap/install.sh | bash -s -- --prefix /opt/sv

bootstrap/install.sh downloads a published release, verifies it, and runs the install.sh inside it. Nothing about how releases are built or published changes. It lives under bootstrap/ because the root install.sh is the installer inside the archive.

What it does

1. Resolves the tag once: VERSION (v4.2.0 or 4.2.0), or the tag GitHub's /releases/latest redirects to.
2. Downloads SHA256SUMS and sv-helper-linux.tar.gz or sv-helper-darwin.tar.gz, over HTTPS only, redirects included.
3. Checks the archive against SHA256SUMS.
4. If packslip is on PATH, verifies the signature against .github/workflows/main.yaml@. Otherwise it says the signature wasn't checked.
5. Unpacks the archive and runs its install.sh "$@", with the environment passed through, so PREFIX and DESTDIR work.

Exit statuses: 2 missing tool, 3 unsupported OS, 4 no such or invalid release, 5 download failed, 6 verification failed, 7 unpack failed, 8 no temp dir. Otherwise it exits with install.sh's own status. Nothing runs until the last line calls main, so a truncated download does nothing.

Written in bash in your style: no semicolons, no set -euo pipefail, and every command checked with if, if !, or a || { block.

Checked against the real releases

Run through a pipe, as users will run it, against GitHub on this host:

• latest (v4.2.0) installed all 11 commands, and svls --version reports 4.2.0
• VERSION=4.0.0 passed real packslip signature verification and installed
• VERSION=v3.5.0, which has no assets, gets a 404 that's named, exit 4
• VERSION=v.0.1 is refused before any download, exit 4
• the temporary directory was gone afterwards

Tests

test/bootstrap.bats (15 tests) installs from a payload built with ci/build_release_payload.sh and served over file://, with no network. Covered:

• a pinned version, a v-less version, and PREFIX from the environment
• a missing release, and an invalid version
• a tampered archive, and an archive missing from SHA256SUMS
• a signature that passes, one that fails, and a missing bundle (through a fake packslip)
• an unsupported OS (through a fake uname)
• install.sh's own exit status
• truncation before main, and truncation inside it
• cleanup, and no privilege escalation

Resolving "latest" needs GitHub's redirect, so the suite doesn't cover it. I checked it by hand above. make test passes locally (135 tests).

🤖 Generated with Claude Code