Harden installer archive extraction

[ryanfowler]

Summary

• Replace full tarball extraction in install.sh with a targeted stream extraction of the expected fetch binary.
• Write the payload to a controlled temp path, then move it into place and set executable permissions.
• Prevent archive path traversal and symlink-based writes outside the temp directory during install.

Testing

• bash -n install.sh
• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings