release: add native installers for v0.1.1

[debpalash]

Summary

• ship Linux AppImage, DEB, RPM, and tar.gz artifacts
• ship a macOS DMG with Bootable.app and an explicit protected-helper installer
• ship Windows MSI/setup EXE, portable GUI/TUI EXEs, and ZIP artifacts
• verify installer contents, embedded versions, checksums, and archives before publication
• publish SHA-256 sidecars and provenance for every release artifact
• bump the patch release and download pages to v0.1.1

Safety and parity

Every native installer carries both the desktop and terminal binaries. DEB/RPM and Windows installers place the narrow write helper at the existing fixed protected path; the macOS DMG exposes a separate administrator-authenticated helper installation step. No removable drive selection or write safety gate changes.

Local validation

• cargo +1.98.0 fmt --all --check
• cargo +1.98.0 clippy --workspace --all-targets -- -D warnings
• cargo +1.98.0 test --workspace (112 passed, 3 intentionally ignored)
• cargo +1.98.0 check --workspace
• npm ci --prefix site && npm run build --prefix site (14 routes)
• Actionlint 1.7.7
• ShellCheck 0.11.0
• PowerShell 7.6.5 parser for both Windows packaging scripts