One-command Cargento CLI and plugin installer

[iamcxa]

Give Cargento users one checksum-verified command that installs both the standalone launcher and Claude plugin.

What changed

• Build deterministic runtime archives, checksums, and versioned installers.
• Track the latest release while retaining an exact-tag installation path.
• Install the launcher and configure cargento@spacedock idempotently.
• Preflight gzip and reject non-file/non-directory archive members before extraction.
• Document foreground server startup, loopback URL, Ctrl-C shutdown, and diagnose-only use.
• Publish the reusable development workflow while keeping entity state local.
• Record validation metrics before publication and reject missing or duplicate rows.

Evidence

• Canonical validation: 361/361 passed; one existing platform skip; 83.9% coverage.
• Linux GNU tar/gzip focused validation: 23/23 passed.
• Documentation and link validation: 32/32 passed.

Review guidance

Focus on installer trust boundaries and deterministic release asset generation.

---

Audit: local-only workflow receipt; product head 3885a66.

[github-actions]

Coverage

Name                                      Stmts   Miss Branch BrPart  Cover
---------------------------------------------------------------------------
cargento/skills/cargento/notify_hook.py      49     16      6      1  65.5%
cargento/skills/cargento/server.py         2582    333   1090    141  85.9%
scripts/build_release_assets.py              58      3     10      2  92.6%
scripts/bump_version.py                      56     13     20      3  73.7%
scripts/lint_embedded.py                     82      9     26      4  86.1%
scripts/validate_plugins.py                 506    162    278     51  63.6%
---------------------------------------------------------------------------
TOTAL                                      3333    536   1430    202  81.9%

Threshold: fail_under in pyproject.toml · label coverage-exception to bypass (visible in PR timeline).