fix: install.sh sha256 URL + error handling

[wavekat-eason]

Summary

Three install.sh bugs surfaced when v0.0.5 became the first release with all assets actually attached and a real user ran the curl|sh path:

1. Wrong checksum URL. Script built `.tar.gz.sha256`, but `taiki-e/upload-rust-binary-action` uploads the checksum as `--.sha256` (no `.tar.gz`). Build the correct name explicitly.
2. Swallowed fetch failures. `sha=$(fetch_stdout … | awk …)` masks curl's exit status — a 404 produced an empty `sha` and the confusing `checksum mismatch (expected , got …)` we saw in the wild. Capture the body first, then awk, then check non-empty.
3. Variable shadowing in `verify_sha256`. POSIX `sh` has no `local`; `archive="$1"` clobbered the caller's `$archive`, so once feat: browser login + table views + colour + release-plz #1 and chore: release v0.0.2 #2 were fixed `tar` got a doubled path. Rename the locals.

Test plan

• Verified locally against v0.0.5 on aarch64-apple-darwin: `WK_INSTALL_DIR=/tmp/x sh ./install.sh` succeeds and the installed `wk --version` runs.
• After merge, install.sh attached to v0.0.6 (or whatever release-plz cuts next) should work end-to-end on macOS arm64/x86_64 and Linux x86_64/arm64.

🤖 Generated with Claude Code