Publish stable installer scripts from Wright releases

[e54-bot]

Summary

• Publish canonical install.sh and install.ps1 from each successful stable release to the existing wrightkit-release R2 bucket at wright/install.sh and wright/install.ps1.
• Serve those objects from install.wrightkit.dev, connected as an additional custom domain for the same bucket. Public URLs keep the /wright/... prefix, which maps directly to the object keys; no URL rewrite is required.
• Set no-store headers on the stable installer entrypoints.
• Verify fetched bytes, cache headers, and content types over HTTP/1.1 before advancing the stable version pointer.
• Record the release and hosting contract in ADR-0019 and docs/release.md.

Verification

• bash -n scripts/publish-r2.sh
• shellcheck scripts/publish-r2.sh
• actionlint .github/workflows/release.yml
• git diff --check

Deployment dependency

Before the next stable publication, connect install.wrightkit.dev as another R2 custom domain for the existing wrightkit-release bucket and allow the public HTTP/1.1 route. The release job will verify the live response. No real publication has been run from this change yet.