chore: import upstream snapshot with attribution

.github/workflows/install-script.yml

@@ -0,0 +1,100 @@
+# Smoke-test scripts/install.sh on Linux + macOS against the latest published
+# release. The script is the public install path served at get.gortex.dev, so
+# any change must prove it still produces a working `gortex` binary. Coverage:
+# Linux x64 (ubuntu-latest) and macOS arm64 (macos-14). Intel macOS is not
+# tested here — GitHub retired its Intel (macos-13) runners, and install.sh is
+# arch-agnostic (only the downloaded artifact differs). Linux arm64 is
+# exercised in the release flow.
+name: install-script
+
+on:
+  pull_request:
+    paths:
+      - "scripts/install.sh"
+      - "scripts/install.ps1"
+      - ".github/workflows/install-script.yml"
+  push:
+    branches: [main]
+    paths:
+      - "scripts/install.sh"
+      - "scripts/install.ps1"
+
+jobs:
+  posix-syntax:
+    # Cheap pre-check: catch bashisms before we spin up the full matrix.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: shellcheck (sh dialect)
+        run: shellcheck -s sh scripts/install.sh
+      - name: POSIX dash syntax check
+        run: dash -n scripts/install.sh
+
+  install:
+    needs: posix-syntax
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Run install.sh into an isolated prefix
+        run: |
+          set -eux
+          export GORTEX_INSTALL_DIR="$RUNNER_TEMP/bin"
+          export GORTEX_NO_PATH=1
+          # Don't clobber the runner's real shell rc; HOME points to a tmp dir.
+          export HOME="$RUNNER_TEMP/home"
+          mkdir -p "$HOME"
+          ./scripts/install.sh
+
+      - name: Verify binary runs
+        run: |
+          set -eux
+          "$RUNNER_TEMP/bin/gortex" version
+
+      - name: Re-run install (idempotency + backup)
+        run: |
+          set -eux
+          export GORTEX_INSTALL_DIR="$RUNNER_TEMP/bin"
+          export GORTEX_NO_PATH=1
+          export HOME="$RUNNER_TEMP/home"
+          ./scripts/install.sh
+          # Previous binary should have been moved aside.
+          test -f "$RUNNER_TEMP/bin/gortex.previous"
+          "$RUNNER_TEMP/bin/gortex" version
+
+      - name: PATH update writes idempotent marker block
+        run: |
+          set -eux
+          export GORTEX_INSTALL_DIR="$RUNNER_TEMP/bin"
+          export HOME="$RUNNER_TEMP/home2"
+          export SHELL=/bin/bash
+          mkdir -p "$HOME"
+          touch "$HOME/.bashrc"
+          ./scripts/install.sh
+          ./scripts/install.sh
+          # Marker block must appear exactly once.
+          count=$(grep -c '^# >>> gortex installer >>>' "$HOME/.bashrc")
+          test "$count" = "1"
+
+  powershell-syntax:
+    # Parse-check install.ps1 — the PowerShell counterpart of the
+    # posix-syntax job. A full install can only run once a release ships
+    # Windows artifacts, so this validates that the script parses without
+    # errors on every change.
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Parse install.ps1
+        shell: pwsh
+        run: |
+          $errors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile(
+            (Resolve-Path scripts/install.ps1), [ref]$null, [ref]$errors) | Out-Null
+          if ($errors) { $errors; exit 1 }
+          Write-Host "install.ps1 parses cleanly"