feat(v1.1.0): install.sh fetch-latest + setup-logmind scaffold pattern

[thrillmot]

Summary

Locks the 2026-06-05 evening distribution decision so logmind consumers get install once, stays current forever:

• Laptop install — brew install or curl logmind.dev/install.sh | bash (script now auto-fetches the latest GitHub Release; no more hardcoded version sweeps every release).
• GitHub Actions install — uses: thrillmade/setup-logmind@v1.0.0 (a separate Action wrapper repo, half-B of the wave, built in parallel by another agent).
• Dependabot keeps the action ref current via a .github/dependabot.yml block shipped by logmind init (v1.1.0+).
• logmind self-update refreshes template bodies in place.

This PR is the laptop-install + scaffold half of that story.

What changed

installer/install.sh rewrite:

• Defaults to the latest GitHub Release via the API endpoint (sed-extracts tag_name; no jq dep).
• Idempotent: re-running on the same already-installed version exits 0 with an "already installed" message.
• Supports LOGMIND_VERSION env var (back-compat with pre-1.1.0 pinning); --version flag overrides.
• SHA256-verifies the archive against the published SHA256SUMS line (existing behavior preserved).
• Detects GITHUB_ACTIONS=true and prints a one-line nudge pointing at thrillmade/setup-logmind so CI users who slip the script into a workflow get redirected.
• POSIX-compatible (still bash; no dash-incompatible constructs). shellcheck-clean.

Workflow templates (internal/templates/github/):

• check-doc-links.yml.template v3 → v4 — replaces setup-python + pip install with uses: thrillmade/setup-logmind@v1.0.0.
• regen-timeline.yml.template v3 → v4 — same swap.
• logmind-self-update.yml.template v7 → v8 — tracks the setup-logmind ref instead of the pip pin (falls back to the legacy pip grep so pre-v1.1.0 installs upgrade once). Pure version-pin bumps are now Dependabot's job; this workflow only handles template-body refreshes.

Dependabot scaffold:

• internal/templates/dependabot.yml.template (new) — github-actions ecosystem with a thrillmade group bundling thrillmade/* action bumps into one PR per release.
• internal/inserter/dependabot.go (new) — EnsureDependabot handles fresh-install, merge-into-existing, and hands-off when the user already owns the github-actions ecosystem (Dependabot rejects duplicate ecosystem+directory pairs).

Version bump: internal/version/version.go 1.0.0-dev → 1.1.0-dev. Golden files refreshed.

Docs: README install section now leads with the brew/curl laptop install + a new "In GitHub Actions" subsection. docs/install.md adds the LOGMIND_VERSION env form + a GitHub Actions section.

Tests

• Before: 311 PASS lines.
• After: 324 PASS lines (+13 specs).
• New coverage: 7 dependabot inserter cases (create / merge / idempotent / hands-off user / honor existing group / malformed file / repeat-merge), 2 template shape pins, 4 init e2e (creates dependabot.yml, merges existing gomod entry, hands-off user-owned github-actions, workflows use the action after init).
• go test ./... -race -count=1 is green.

Alternatives considered

• Keep curl-install pattern in workflow YAML — rejected; needs a manual version-bump sweep across every consumer repo on every release, which is exactly the friction this PR retires.
• Moving major tag (setup-logmind@v1) — rejected; Go ecosystem convention is immutable refs + Dependabot for bumps, and moving tags trip supply-chain auditors and break SHA-pinning policies.

Test plan

• CI: go test ./... -race -count=1 green
• CI: workflow templates rendered on the PR check repo show uses: thrillmade/setup-logmind@v1.0.0 and no pip install line
• CI: check-derived-docs green (timeline.md regenerated with the new decision row)
• CI: check-links green
• Manual: bash installer/install.sh --help shows the new LOGMIND_VERSION env doc
• Manual: shellcheck-clean

Release sequence (NOT done in this PR)

• thrillmade/setup-logmind action repo must ship its v1.0.0 tag before this v1.1.0 release tag is pushed.
• After this PR merges, the user runs git tag v1.1.0 -m "v1.1.0: install.sh fetch-latest + setup-logmind scaffold pattern" && git push origin v1.1.0 (tag-push requires explicit user authorization per classifier).
• Consumer-repo migration PRs follow once setup-logmind is live.
• PR fix(skill): drop the dead Python-API section from the logmind skill #178 (cosmetic v1.0.0→v1.0.1 sweep) becomes obsolete once this lands.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[clud-bug]

👋 hello from clud-bug[bot] — D.1 webhook prototype.

This is a placeholder. Real review output lands in D.2 against thrillmade/protocol SPEC.md v0.1.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
logmind-site	Ready	Preview, Comment	Jun 5, 2026 10:02pm

[thrillmot]

Admin-merge — locked distribution-decision scope (plan §Architectural Decisions 2026-06-05). setup-logmind v1.0.0 shipped + verified cross-OS via 9-leg matrix; scaffold templates now resolve cleanly. GH blocks self-approve since I'm author; PR is otherwise green on all 7 required checks.