feat(installer): use GitHub API digests for checksum verification

[CalvinAllen]

Summary

• Replace separate .sha256 checksum files with GitHub's built-in SHA256 digests from the release API
• Update install.sh to fetch release info from API and extract digest using grep/sed (no jq dependency)
• Update install.ps1 to use Invoke-RestMethod for native JSON parsing of release data
• Remove .sha256 file generation and upload steps from release workflow
• Graceful fallback: If digest is not available (older releases), verification is skipped with a warning

Test plan

• Test install.sh on Linux/macOS with current release (should warn about missing digest)
• Test install.ps1 on Windows with current release (should warn about missing digest)
• Verify release workflow builds successfully without .sha256 generation
• After next release, verify installers correctly fetch and verify digests from API

Closes #103