Build prebuilt releases, installable with one command

[ParallelEntrepreneur]

A version tag now publishes a GitHub release with a prebuilt app for Linux x86_64
and one for Apple Silicon, plus an installer:

curl -fsSL https://colonizer.dev/install.sh | sh

Nothing on the machine needs Rust or Node.js to install it.

.github/workflows/release.yml

• linux-binaries: builds colonizer-agentd and rtk for both colony architectures,
  and the Linux harness, as static musl binaries. They are built inside
  rust:1-alpine with docker run, because GitHub's JavaScript actions don't run
  in Alpine containers. A static harness starts on any glibc; one built on the
  Ubuntu 24.04 runner would not start on Debian 12 or Ubuntu 22.04.
• bundle: runs scripts/install.sh --bundle on ubuntu-24.04 and macos-15, then a
  smoke test. The app starts from the unpacked archive, finds its assets there,
  reports agentd, the web UI and the claude-code module, and serves the UI.
• release: runs for tags only. The tag must match crates/colonizer's version. It
  writes SHA256SUMS and publishes the archives with install.sh.

A release contains no Anthropic code. The Claude Agent SDK is "all rights reserved",
and its optional platform packages are Claude Code itself (224 MB).

• The bundle installs the module with --omit=optional. The runner already passes
  pathToClaudeCodeExecutable, so those packages were never used.
• scripts/record-fetch-at-install.mjs takes the SDK out and writes its lockfile
  tarball URL and sha256, after checking the tarball against package-lock.json's
  integrity.
• scripts/install-release.sh fetches the SDK from the npm registry against that
  record. On a Mac it also fetches the linux-arm64 Claude Code build from
  Anthropic's stable channel, checked against the manifest. macOS's own plutil
  reads the manifest, so no Node.js is needed. The Workflow's Package step fails
  if the SDK is found in a bundle.

scripts/install-release.sh (published as install.sh)

• Refuses platforms it can't serve, including Linux without read-write /dev/kvm.
• Checks the archive against SHA256SUMS.
• Swaps ~/.local/share/colonizer/app in whole, and links ~/.local/bin/colonizer.
• Running it again updates in place. It reuses a Claude Code binary that still
  matches the manifest, and never touches settings or colonies.
• Accepts COLONIZER_VERSION, COLONIZER_APP and --pull-image.
• Everything runs inside main(), so a truncated download runs nothing.

scripts/install.sh --bundle skips the KVM check and the Claude Code fetch, and
uses binaries from $COLONIZER_PREBUILT instead of building them.
build-agentd.sh and build-rtk.sh accept COLONIZER_BUILD_HERE=1, to build inside
an existing rust:1-alpine instead of a microVM. rtk's source is then unpacked
outside the repository, because cargo refused to build it as a stray member of
the harness workspace (the local test below caught that).

Tested on an Apple Silicon Mac:

• In a rust:1-alpine microVM with COLONIZER_BUILD_HERE=1: agentd, rtk and the
  harness built as static aarch64 musl binaries. The static harness started in a
  Debian (node:24-bookworm) microVM and served /api/status.
• install.sh --bundle with those guest binaries: a 129 MB app, a 44 MB archive,
  and no Agent SDK inside.
• curl … | sh against the archive served locally, into an empty HOME, took 41 s.
  It fetched the SDK (sha256 checked) and Claude Code 2.1.267 (manifest checked).
• The installed app reported its assets in the new location: agentd, web,
  claude-code, the guest Claude binary, and msb 0.6.18 from the relocated vendor
  directory. It served the UI.
• Running the installer again reused Claude Code, left no app.new or app.old,
  and kept the data directories.
• The installed colonizer-agentd, rtk and claude-guest each ran --version
  inside node:24-bookworm.
• The runner's 58 tests passed against an SDK restored from the npm tarball
  without optional packages.

Not tested yet:

• The workflow itself; this pull request is its first run.
• The linux-x86_64 bundle end to end.
• Launching a colony from an installed release.
• colonizer.dev/install.sh, which the website adds once a release exists. Until
  then, install from the release URL directly.