feat: publish installer at sbsh.io/install.sh with --check/--help and docs one-liner

[eminwux]

Summary

Completes the hosted one-liner front door for #429. The issue's premise has partially rotted: it was filed assuming "sbsh has no install.sh anywhere today", but #428 (2af1bbb, merged after #429 was filed) already shipped a comprehensive scripts/install.sh (OS/arch detection, latest-tag resolution, SBSH_VERSION/SBSH_INSTALL_PREFIX overrides, gated/skippable/graceful checksum, sb hardlink). The hosted-one-liner goal of #429 remained unmet, so this PR ships only the genuinely-missing pieces rather than re-implementing #428:

• --check / --help flags on scripts/install.sh. --check runs prerequisite checks only (OS/arch support, curl, a SHA-256 tool, install-prefix writability/sudo) and mutates nothing; --help prints usage and the honored env vars. Both added via a new main() arg parser; the bare curl | bash path is unchanged.
• Published mirror at docs/site/install.sh — a byte-identical copy of scripts/install.sh. Because mkdocs.yml sets docs_dir: docs/site and docs/site/CNAME is sbsh.io, this file is served at https://sbsh.io/install.sh with no extra infra (same mechanism kukeon uses).
• Sync guard: make install-sh-sync regenerates the mirror; make install-sh-check (CI-friendly) fails if the two have drifted. Documented inline in the Makefile.
• Docs sweep of the six AC-named files: README.md, docs/README.md, docs/site/getting-started.md, docs/site/index.md, docs/site/install/install-linux.md, docs/site/install/install-macos.md now feature curl -fsSL https://sbsh.io/install.sh | bash as the primary path, with the manual version-pinned block retained as the air-gapped / pinned fallback.

Non-obvious calls (please push back)

• README.md one-liner was flipped, not gated. feat: add one-line install script (curl | bash) #428 had pointed the README one-liner at raw.githubusercontent.com/.../scripts/install.sh. The AC explicitly wants the sbsh.io/install.sh mirror, so all six docs (including README) now use sbsh.io. The raw.githubusercontent URL is preserved as a comment in the script header for the pre-Pages-deploy case.
• docs/site/index.md points to the manual path rather than duplicating it. index.md's Quick Start is an intentionally-minimal landing snippet (install + start a terminal); I replaced its version-pinned block with the one-liner and a link to Getting Started's manual section, rather than inlining the full air-gapped block on the landing page. Every other file retains its own manual fallback block. Flag if you'd prefer the block inlined here too.
• Mirror is a committed copy, not a symlink or build artifact. A committed byte-identical copy matches kukeon's precedent and lets cmp drift-check it; a symlink risks not being followed by Pages. Drift is guarded by make install-sh-check.
• Scope held to the six AC files. Other version-pinned download blocks exist in docs/cicd.md, docs/site/guides/cicd.md, and docs/site/tutorials/automate-terminal-workflows.md; those are CI/tutorial contexts outside the AC's enumerated six, left untouched (no scope creep).

Acceptance criteria

• scripts/install.sh exists and is executable; published copy served at sbsh.io/install.sh (committed docs/site/install.sh + documented make install-sh-sync step).
• OS/arch auto-detected; no manual OS/ARCH export (already from feat: add one-line install script (curl | bash) #428; unchanged).
• Latest tag resolved automatically; SBSH_VERSION=<tag> pins (already from feat: add one-line install script (curl | bash) #428; unchanged).
• SBSH_INSTALL_PREFIX overrides the install dir (already from feat: add one-line install script (curl | bash) #428; unchanged).
• Checksum verification runs when a .sha256 asset is present, skippable via SBSH_SKIP_CHECKSUM=1, degrades gracefully when absent (already from feat: add one-line install script (curl | bash) #428; unchanged). Still gated on Release - Generate SHA256SUMS for all release assets and upload with the GitHub Release #56 for assets to verify against.
• --check runs prerequisite checks only and touches nothing; --help prints usage and env vars. (new — verified locally, see test plan)
• README + the five other docs feature the one-liner as primary, manual block retained as fallback.
• curl -fsSL https://sbsh.io/install.sh | bash installs on linux/darwin × amd64/arm64 — the script logic is unchanged from the feat: add one-line install script (curl | bash) #428 install path; the sbsh.io URL itself only resolves after this merges and GitHub Pages redeploys docs/site/, so the live end-to-end fetch is not runnable pre-merge. Verified by mirror-identity (make install-sh-check) + feat: add one-line install script (curl | bash) #428's existing install path.

Test plan

• bash -n scripts/install.sh — syntax clean
• bash scripts/install.sh --help — prints usage + env vars, exit 0
• bash scripts/install.sh --check — reports OS/arch/curl/sha256/prefix, exit 1 on unwritable /usr/local/bin without sudo; SBSH_INSTALL_PREFIX=/tmp/... --check exits 0; confirmed no dir/file mutation
• bash scripts/install.sh --bogus — errors with usage, exit 1
• make install-sh-check passes; tamper + make install-sh-sync re-sync verified
• make test (full suite incl. e2e) — TEST-EXIT=0
• go build ./..., go vet ./... — clean
• make sbsh-sb — produces ELF sbsh + sb hardlink (ELF magic verified; file absent on host)

Closes #429

[eminwux]

PR #433 Review — feat: publish installer at sbsh.io/install.sh with --check/--help and docs one-liner

Solid, well-scoped PR. The mirror is genuinely byte-identical (scripts/install.sh and docs/site/install.sh resolve to the same git blob db5927c at head; cmp -s confirms), docs_dir: docs/site + CNAME sbsh.io serves it at sbsh.io/install.sh, the new --check path is read-only (no mktemp/writes), set -e is correctly guarded via if run_checks, and the [Manual Installation](#manual-installation) anchors resolve in both install docs. No secrets, all commits verified, scope held to the six AC files. The documented unrunnable AC (live sbsh.io fetch only resolves post-merge after Pages redeploys) is a legitimate host-gated deferral — worth a manual curl -fsSL https://sbsh.io/install.sh | bash smoke once Pages redeploys.

One non-blocking item:

• CI enforcement .github/workflows/installer.yaml:7-15: the new make install-sh-check drift guard isn't wired into CI, and the path filter watches only scripts/install.sh, not the mirror. The files are in sync now, but a future edit to scripts/install.sh without make install-sh-sync would silently serve a stale installer at sbsh.io. Adding an install-sh-check step (and docs/site/install.sh to the path filter) closes the loop. Filed as a follow-up — non-blocking.

LGTM — the mirror is correct and consistent today; the CI wiring is a follow-up, not a gate.