Sigil should be provisioned with one machine setup command backed by signed release artifacts.
Acceptance criteria:
- Standard x86_64 Bazzite release asset names are documented and stable.
- Product package is built from clean source and signed with the offline Minisign release key.
- The goq.sh bootstrap embeds the trusted public key and verifies both checksum and detached signature before extraction.
- Bootstrap refuses root, unsupported OS or architecture, unsafe archives, unsigned assets, and partial downloads.
- Installation uses the existing package stager, remains idempotent, preserves rollback, and does not silently start or restart the host.
- A clean Bazzite install and upgrade/rollback are proven from the public command.
Sigil should be provisioned with one machine setup command backed by signed release artifacts.
Acceptance criteria: