feat(security): SHA256 verification + icm upgrade --apply command

[pszymkowiak]

Summary

Adds mandatory SHA256 verification to all install/upgrade paths.

install.sh

• Downloads checksums.txt alongside the binary archive
• Verifies SHA256 before extraction
• Aborts install if checksum mismatch (tamper detection)
• Works on macOS (shasum) and Linux (sha256sum)

New `icm upgrade` command

• `icm upgrade --check` — check if new version available (no install)
• `icm upgrade --apply` — download + verify + install atomically
• Mandatory SHA256 verification before replacing the running binary
• Atomic replacement with rollback on failure
• Refuses to upgrade if SHA256 mismatch

Security properties

• No binary is ever installed without SHA256 verification (install + upgrade)
• Checksums are published by the release workflow (already creates `checksums.txt`)
• User sees the verified hash on success, error on mismatch

Test plan

• `cargo build` OK
• `icm upgrade --check` correctly reports current vs latest
• Install script checksum verification tested

[pszymkowiak]

wshm · Automated triage by AI

📊 Automated PR Analysis

✨ Type	feature
🔴 Risk	high

Summary

Adds mandatory SHA256 checksum verification to the install script and introduces a new icm upgrade command (with --check and --apply flags) that downloads, verifies, and atomically replaces the running binary. Also switches JSON config parsing to serde_json_lenient to tolerate trailing commas in user-edited files.

Review Checklist

• Tests present
• Breaking change
• Docs updated

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.