Add one-command installers and sync version with release tags

[waveFrontSet]

Summary

• Adopt binstaller for one-command installation on Unix-like systems: .config/binstaller.yml maps existing release asset names, install.sh is generated via binst gen (version-independent, regenerate only if config changes).
• Add install.ps1 for native Windows PowerShell installs.
• Version sync: bump package.yaml from 0.1.0.0 to 0.5.0 (matching the latest published tag); add a --version flag; add a CI tag guard that fails the release if the tag doesn't match v<package.yaml version>.
• README: new Installation section (curl one-liners + manual fallback + Apple-Silicon-only note), AI explanations documentation, trophies, and config-file locations. Add --version to the options table and explanation-scrolling keys to Controls.

Test plan

• binst check validates config against real v0.5.0 release assets
• sh install.sh -b <dir> downloads and installs the macOS aarch64 release binary
• cabal build && cabal run cert-prep -- --version prints 0.5.0
• cabal test passes (126 examples, 0 failures)
• Tag guard logic: passes on matching tag, fails on mismatches
• Push a throwaway tag (v0.0.99) to exercise the negative path (tag guard gates the build, no release created)
• After merge to main, verify raw.githubusercontent install URLs resolve (200 OK)
• Next release: push a tag with mismatched version to trigger the guard, then with correct version to trigger the full build

Notes

• No changes to the existing build/upload logic in .github/workflows/release.yml beyond adding the tag guard job; asset naming and release creation remain untouched.
• Checksum embedding/GitHub attestation verification is deferred (no checksum file published yet, would require a regenerate-and-commit step on every release).

🤖 Generated with Claude Code