Simplify release architecture and add one-command installation - #117

Summary

• Release manifest schema 2 requires exactly one compiler and one toolchain per host; native runtime is bundled inside the compiler pack and the target pack kind is removed.
• Six host-local release jobs replace the 24-job compiler/runtime/verify fan-out. Each host fetches its immutable toolchain once, builds compiler and native runtime, packages one host pack, and verifies fresh installation (doctor + x_test fixtures) before upload.
• Sign, checksum, and draft publication collapse into one protected finalization job holding the Ed25519 private key and contents:write. SBOM and GitHub provenance attestation are removed.
• New POSIX and PowerShell bootstrap installers (install.sh, install.ps1) detect OS/arch, verify the native installer against SHA256SUMS, run it, and persist user PATH idempotently. README gains one copy-paste install command per OS.
• Toolchain planner lock-path migration branches removed; fingerprints unchanged, so no toolchain rebuild is scheduled.

Validation

• gofmt clean; git diff --check clean
• go test ./... — all packages pass
• go test -race ./... — all packages pass
• bash -n on all changed scripts; YAML parse of release.yml, release-host.yml, ci.yml
• Toolchain fingerprints recomputed unchanged; toolchains/ diff empty
• PowerShell parser validation and actionlint run in CI (pwsh/actionlint unavailable locally)

Follow-ups

• Tracks Ship signed cross-platform compiler distributions #102 (Ship signed cross-platform compiler distributions). Project status update pending: token lacks read:project scope.