feat(linux): add checksum-verifying release installer

[SarthakWade]

Summary

• add a public Linux bootstrap that resolves latest or pinned releases, selects amd64/arm64, verifies the tarball against SHA256SUMS, and rejects archive-shape drift before extraction
• delegate Chromium and Snap validation to the product runtime resolver instead of maintaining a second shell implementation
• align FFmpeg preflight with the runtime absolute-path allow-list and fail closed on invalid overrides
• publish the bootstrap with tagged releases and document native installation and verification
• add offline adversarial installer coverage for version, architecture, checksum, archive contents, and override boundaries

Validation

• pnpm test
• pnpm test:runtime
• pnpm test:e2e:linux
• HEADLESS_LINUX_PLATFORM=linux/arm64 ./apps/headless/build-linux.sh
• ./apps/headless/build.sh
• pnpm test:e2e:mac
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• actionlint .github/workflows/release.yml
• shellcheck apps/headless/install.sh apps/headless/install-linux.sh apps/headless/Tests/linux-installer.sh
• pnpm dlx prettier --check CHANGELOG.md README.md docs/roadmap/improvements-backlog.md
• git diff --check

Closes #40