v0.15.24 — pinned install assets

install.sh resolves main to ONE immutable commit sha and fetches the bundle, its .sha256 and every managed asset from raw//, so the two objects can no longer come from different CDN cache generations. The checksum guard is byte-for-byte unchanged; the mismatch message now separates pinned bad-bytes from unpinned cache skew instead of alleging a tampered mirror.

Verified in a live post-release window: unpinned /main served the previous bundle (83e57a92) beside the new checksum (a50fb089) across the whole window, while the pinned tree stayed self-consistent on every poll. (DIVE-1977)