security: verify Windows release archive checksum/signature before extraction (install.ps1 + self-upgrade) #954

Found during the v0.8.8 release review (CTO + Tech Lead, P2 deferred).

install.ps1 performs no SHA256/signature verification of the downloaded release archive before Expand-Archive; integrity relies entirely on HTTPS to github.com. The same gap applies to the Windows self-upgrade path (upgradePowershell does irm | iex of the same unverified script). A compromised release asset, a TLS-defeating MITM, or a release-pipeline mistake would be silently extracted and executed as altimate.exe.

This matches the existing bash-installer posture (the script comment is honest about it), so it is deferred — the real fix is release-side, then verify in both installers:

1. Release workflow publishes a checksums.txt (ideally a cosign/minisign signature) per release asset.
2. Both install.ps1 and the bash install verify the downloaded archive's SHA256 against it before extraction.

Deferred because it requires release-pipeline + signing design work, not an in-repo patch, and does not regress the already-shipping bash posture.