fix(007): quiet installer tag lookup; spec complete after live check

[bartekus]

Summary

• install.sh: the latest-release resolution streamed the GitHub API response into grep -m1, which closes the pipe as soon as the tag line is found; curl then printed a spurious (56) Failure writing output line on the happy path (observed during the v0.1.0 live check). The response is now buffered before parsing, with a comment recording the constraint.
• specs/007: status section records the acceptance evidence and flips implementation to complete. v0.1.0 (signed tag on 4f0cc73, run 29964581207) went green first run: version guard passed, all five legs built, all fifteen assets published. Live check in hard mode (STATECRAFT_REQUIRE_ATTESTATION=1): checksum verified, provenance attestation verified, installed aarch64-apple-darwin binary reports statecraft 0.1.0 with the correct JSON envelope.
• Also records the deferred cosmetic follow-up: the pinned actions/checkout emits a Node 20 deprecation notice; bump ci.yml and release.yml pins together later.

Testing

• spec-spine compile / index / lint --fail-on-warn / index check green; couple --base origin/main --head HEAD: 2 paths checked, no drift.
• sh -n install.sh clean.
• Live retest of the patched installer against the published v0.1.0: clean output, no curl error line, attestation verified, binary installs and runs.