Replace Go installer with pure-script installation - #120

Bundle native runtime into compiler pack and require exactly one compiler
and one toolchain per host in release manifest schema 2. Replace 24-job
component release with six host-local pipelines that each fetch their
immutable toolchain once, build compiler and runtime, package one host
pack, and verify fresh installation before upload. Collapse sign,
checksum, and draft publication into one protected finalization job and
remove SBOM and provenance attestation. Add POSIX and PowerShell
bootstrap installers that detect the platform, verify the native
installer against SHA256SUMS, run it, and persist user PATH
idempotently. Remove completed lock-path migration from the toolchain
planner without changing fingerprints.

Component downloads now run concurrently so total install time tracks the
largest pack instead of the sum, with one aggregate throttled progress line
on stderr. Progress counts bytes on the write side of the copy so streamed
data is reported accurately. README drops compiler pipeline and repository
layout sections and the stale no-binary-release note.

The installer binary download is large enough to need feedback; curl now
uses a stderr progress bar and PowerShell keeps its default progress for
that step only. The tiny SHA256SUMS fetch stays silent.

Bootstrap scripts now perform the full installation: download the release
manifest, verify it against SHA256SUMS, read pack URLs and SHA-256 digests
for the detected host, download compiler and toolchain packs, verify every
digest, extract into staging on the destination filesystem, and activate
atomically. Removes cmd/peeper-installer and internal/installer, dropping
six installer builds and assets per release; release assets drop to 11.
Manifest signing stays for out-of-band audit.