Harden install.sh checksum verification and completion handling

[ryanfowler]

Summary

• Verify downloaded release archives against their .sha256 sidecars before extraction.
• Make shell completion installation opt-in via --completions or FETCH_INSTALL_COMPLETIONS=1.
• Default installs now print manual completion commands instead of editing shell startup files.

Testing

• bash -n install.sh
• shellcheck install.sh
• Offline installer smoke tests covering checksum verification, checksum mismatch failure, and opt-in completion installation
• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings