* feat(install): add standalone release setup

Document one-command installation, optional private CLI setup and explicit restart consent. Preserve updater JSON modes and existing configuration. TODO parity entries are unaffected.

* fix(install): validate local package and secure bootstrap

Reject an installed directory with the wrong applet identity before using its helper. Download the README installer into a private temporary directory, and distinguish fresh installation from upgrade in setup messages. Verified with setup tests, ShellCheck, make check and make package.

* feat(install): simplify secure terminal bootstrap

Keep the README command on one line by downloading the standalone installer fully into a shell variable before passing it to Bash. Support setup from stdin and test the path without a checkout. The release and package validation remains unchanged.

* test(cost): allow midnight refresh in timeout lifecycle