NurCLI v0.43.2

NurCLI v0.43.2 - verified updates

A bug and parity pass over the whole codebase, docs and site. Clippy is clean with and without default features; all unit tests, the E2E suite and the regression and startup suites pass.

Updates are checked against the published checksum

• The self-updater (nur update and the launch check) now compares every download with the <asset>.sha256 each release publishes and refuses a mismatch before anything touches disk.
• The updater no longer treats .tar.gz assets as installable. It had accepted gzip bodies as executables and would have written an archive straight over nur, and its fuzzy asset match could reach archive or checksum files.
• SHA-256 hashing runs in process instead of launching certutil / shasum (the updater, the impostor scrub and nur doctor used two copies of that code). nur doctor now reads the install record from NUR_INSTALL_DIR when it is set.

npm shim (npx nur-cli)

• Verifies the published checksum, writes beside the target and renames, and says plainly when a running nur holds the file.
• Its fallback download is the package's own release instead of a stale v0.40.1 pin.

Install and docs

• install.ps1 honors NUR_CLI_DIR, as install.sh and the README already did; the irm | iex one-liner cannot pass -RepoDir.
• The docs site no longer publishes verbatim third-party page and paper captures (docs/research/_extracts) or internal agent plans; pages kept out of the nav on purpose are marked as such.