fix: install single-binary CLI releases

[jBernavaPrah]

What changed

• Cut the public installer directly to the single-binary phoxal release archive.
• Verify one target-matched regular archive member, checksum, installed bytes, and executable mode.
• Replace the destination through a same-directory candidate and atomic rename while protecting symlink victims.
• Remove only the exact legacy phoxald file or symlink and preserve foreign directories.
• Add adversarial POSIX installer coverage and Ubuntu/macOS CI.

Why

CLI v0.37.4 no longer publishes phoxald. The public installer must consume the new archive contract without retaining a legacy reader or leaving the retired executable on PATH.

Validation

• sh -n
• shellcheck -s sh
• sh _tests/install.sh
• actionlint .github/workflows/installer.yml
• git diff --check
• Real v0.37.4 macOS ARM64 archive downloaded, checksum-verified, installed into an isolated prefix, and executed successfully.