v1.7.0 — piped install stops leaking clones

Fixed

• The curl | bash install cloned into mktemp -d and never removed it, leaving a full clone behind on every run. Measured against the real temp root: old script +1 clone per install, new script 0 after 3 installs.
• install.sh now fails with a clear message when python3 or git is missing, instead of erroring out mid-clone.

Added

• CI runs tests and the neutral install on macOS and Linux, and now covers the README's piped install path — which no job exercised before.
• ATSR_REPO_URL makes the piped path testable from a local source.
• README shows license/CI badges and documents requirements (Python 3.11+, Linux/macOS, WSL2 on Windows).

Changed

• Natural exact-name routing without $ syntax, plus bounded complementary bundles: one primary and up to four confidence-gated supports for distinct phases, with visible primary/support roles and scored alternatives. Labeled 28-case benchmark: 26/28 → 28/28 at P@1, zero-skill ambiguity gates intact.