docs: surface exit-code semantics and default to the latest-release install

[Chemaclass]

Context

1. bashdep commands return meaningful capped counts (great for CI gating) but this is buried in behavior.md.
2. README quick-start pins the raw main branch; a pinned releases/latest/download/bashdep + checksum path is more reproducible (partly added already).

Scope

• Add a short "Exit codes / CI usage" section (README + behavior.md) showing how doctor/install/clean return counts and how to gate CI on them.
• Make the pinned, checksum-verified releases/latest/download install the recommended default in README; keep the main raw URL as the "bleeding edge" alternative.

Boundary

Files: README.md, docs/behavior.md. Docs only.

Acceptance criteria

• Exit-code/CI section exists and is accurate against the code
• README leads with the pinned+verified install; examples copy-paste runnable

---

Constraints (apply to all bashdep work)

• Bash 3.2+ compatible — no declare -A, ${var,,}/${var^^}, mapfile, negative array index, &>>.
• Zero runtime deps beyond curl/wget/awk/mktemp/mkdir/rm/cp/mv/printf/cat/grep/sort/tr/dirname/basename + shell builtins.
• TDD: write the failing test first (tests/unit/*_test.sh), then implement; keep make test green for the right reason. Mock curl/wget — no network in tests.
• Quality gate: make test && make sa && make lint must all pass.
• Update docs/api.md / docs/behavior.md when public API or semantics change; add a CHANGELOG.md ## [Unreleased] entry for any user-visible change.
• Conventional commits (ref: for refactors); never mention AI/automation. One PR per issue, assigned to Chemaclass.