Harden release archives and installer verification

[Widthdom]

Summary

• Generate MANIFEST.sha256 inside release archives and make the installer verify every extracted file, including legacy fallback for pre-manifest releases.
• Stabilize release archive member ordering and timestamps, with member-list validation for tar/zip artifacts.
• Mark completed installs with integrity_ok and require that marker before skipping same-version installs.
• Reject unsafe tar members before extraction and replace optional installed directories during reinstall.

Validation

• bash -n install.sh
• dotnet run --project tools/CodeIndex.Changelog -- check
• git diff --check origin/main..HEAD
• bash install.sh --self-test-local-mirror v9.9.9
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj -c Release -p:UseSharedCompilation=false --filter InstallScriptTests
• Codex adversarial review: No blocking/actionable issues found.

Documentation / Changelog

• Updated .codex/workflows/release-changelog.md with manifest and stable-archive release expectations.
• Added changelog fragments:
  • changelog.d/unreleased/2012.fixed.md
  • changelog.d/unreleased/2040.fixed.md
  • changelog.d/unreleased/2041.fixed.md

Issue Scope

• No existing work-start comments were found on Version mismatch between version.json and actual binary silent on partial install #2012, Release archive extraction lacks per-member checksum manifest validation #2040, or Release tar/zip generation lacks reproducible member ordering and timestamps #2041 before starting.
• No extra issues were included.

Fixes #2012
Fixes #2040
Fixes #2041