feat: align one-click install and Rust 1.97.1

[g1e2x87]

Summary

• Problem: PRX had no stable release-hosted one-click installer, release asset names disagreed with the legacy bootstrap path, and the repository still pinned Rust 1.93.0 while supported local builds use 1.97.1.
• Why it matters: new users could not reliably install a verified binary, security audit tooling had already outgrown the old compiler, and README/config examples described stale commands and missing documentation.
• What changed: added Unix and Windows installers, synchronized Rust 1.97.1 across Cargo/CI/Docker/release/audit, hardened release integrity gates, updated Rust 1.97 Clippy compatibility, and refreshed installation/runtime documentation for v0.8.20.
• What did not change (scope boundary): no provider credentials are collected, no service is created or started automatically, and no runtime feature defaults or live configuration are changed.

Label Snapshot (required)

• Risk label (risk: low|medium|high): risk: high
• Size label (size: XS|S|M|L|XL, auto-managed/read-only): size: XL
• Scope labels (core|agent|channel|config|cron|daemon|doctor|gateway|health|heartbeat|integration|memory|observability|onboard|provider|runtime|security|service|skillforge|skills|tool|tunnel|docs|dependencies|ci|tests|scripts|dev, comma-separated): docs, dependencies, ci, tests, scripts, runtime, security
• Module labels (<module>: <component>, for example channel: telegram, provider: kimi, tool: shell): runtime: installer, ci: release
• Contributor tier label (trusted contributor|experienced contributor|principal contributor|distinguished contributor, auto-managed/read-only; author merged PRs >=5/10/20/50): auto-managed
• If any auto-label is incorrect, note requested correction: none

Change Metadata

• Change type (bug|feature|refactor|docs|security|chore): feature
• Primary scope (runtime|provider|channel|memory|security|ci|docs|multi): multi

Linked Issue

• Closes # N/A
• Related # N/A
• Depends on # (if stacked): N/A
• Supersedes # (if replacing older PR): N/A

Supersede Attribution (required when Supersedes # is used)

• Superseded PRs + authors (#<pr> by @<author>, one per line): N/A
• Integrated scope by source PR (what was materially carried forward): N/A
• Co-authored-by trailers added for materially incorporated contributors? (Yes/No): No
• If No, explain why (for example: inspiration-only, no direct code/design carry-over): no superseded contribution was incorporated
• Trailer format check (separate lines, no escaped \n): Pass

Validation Evidence (required)

Commands and result summary:

cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo check --workspace --no-default-features --locked
cargo test --workspace --all-features --locked
cargo audit
cargo deny check
./scripts/ci/rust_toolchain_sync_gate.sh
./scripts/ci/installer_contract_gate.sh

• Evidence provided (test/log/trace/screenshot/perf): all commands passed; library result was 5720 passed, 6 ignored, with all integration suites and doctests green. A real Linux smoke installed and executed the current v0.8.12 release using the new local installer.
• If any command is intentionally skipped, explain why: Windows runtime installation was not executed locally because PowerShell is unavailable; install.ps1 was syntax-validated locally where possible and has a Windows CI parse job.

Security Impact (required)

• New permissions/capabilities? (Yes/No): No
• New external network calls? (Yes/No): Yes
• Secrets/tokens handling changed? (Yes/No): No
• File system access scope changed? (Yes/No): Yes
• If any Yes, describe risk and mitigation: installers download only HTTPS GitHub Release assets, verify a strict SHA-256 sidecar, extract only the expected executable, install into an explicit per-user directory, and atomically replace that executable. Onboarding and credentials remain separate.

Privacy and Data Hygiene (required)

• Data-hygiene status (pass|needs-follow-up): pass
• Redaction/anonymization notes: no user data, credentials, logs, or private URLs added
• Neutral wording confirmation (use OpenPRX/project-native labels if identity-like wording is needed): confirmed

Compatibility / Migration

• Backward compatible? (Yes/No): No
• Config/env changes? (Yes/No): No
• Migration needed? (Yes/No): Yes
• If yes, exact upgrade steps: source builders must install Rust 1.97.1 or newer. Binary users require no config migration; after release they can rerun the installer and restart the existing service explicitly.

Human Verification (required)

What was personally validated beyond CI:

• Verified scenarios: exact-version URL construction, good and bad checksum handling, unsupported architecture rejection, musl rejection, old-Rust source rejection, live Linux download/install/version execution.
• Edge cases checked: missing/malformed checksums, unsupported Linux architecture, Alpine/musl, Rust 1.96 source build, install directory outside PATH.
• What was not verified: native Windows installation and macOS execution; these remain covered by release-matrix builds and the Windows syntax job.

Side Effects / Blast Radius (required)

• Affected subsystems/workflows: local Rust builds, Docker build stage, normal CI, security audit, release publication, developer bootstrap, README/install documentation.
• Potential unintended effects: new MSRV can block older source-build hosts; platform asset mismatch can block installation; Rust 1.97 lint rewrites could expose semantic drift.
• Guardrails/monitoring for early detection: toolchain sync gate, installer contract gate, exact release asset count, tag/package version match, binary version smoke, strict Clippy, full test suite, cargo-audit and cargo-deny.

Agent Collaboration Notes (recommended)

• Agent tools used (if any): Codex repository inspection, shell validation, GitHub CLI
• Workflow/plan summary (if any): baseline audit -> isolated branch -> toolchain alignment -> installer/release implementation -> docs refresh -> full local gate -> delivery
• Verification focus: release integrity, install failure boundaries, Rust 1.97 compatibility, actual CLI/documentation parity
• Confirmation: naming + architecture boundaries followed (AGENTS.md + CONTRIBUTING.md): confirmed

Rollback Plan (required)

• Fast rollback command/path: revert this PR before tagging; after release reinstall an exact prior version with install.sh --version v0.8.12, then restart the service.
• Feature flags or config toggles (if any): none
• Observable failure symptoms: installer checksum/asset errors, release asset completeness failure, build failures on a stale compiler, installed binary version mismatch.

Risks and Mitigations

• Risk: the public one-click URLs do not exist until the first release carrying installer assets.
  • Mitigation: release validation stages both installers and checks all 24 expected assets before publication.
• Risk: compiler and Clippy changes span many source files.
  • Mitigation: changes are mechanical and the full all-features suite passed twice; constant-time comparison and floating-point accumulation were explicitly protected from semantic lint rewrites.