[Story]: The installer ships with every release at a stable URL, and the runbook says so

### Story Statement

As a developer reading the onboarding runbook, step 1 is a single command I can copy — because the installer is published with every release at a URL that never needs updating.

### Real Intent

An installer nobody can reach is not an installer. This story is what turns the script into the documented path, and it removes the hand-rolled `curl` that every Coder workspace image and dotfiles repo currently re-derives — each one re-encoding the platform matrix and drifting from it independently.

### Background and Context

The runbook currently says, verbatim: *"Download the release binary for your platform (macOS arm64/x64, Linux x64/arm64) and put it on `$PATH`. There is no package manager entry yet — copy it into `~/.local/bin` or equivalent."* ([onboard-a-developer-ai-client.md:69](https://github.com/ADORSYS-GIS/lightbridge-governance/blob/main/docs/runbooks/onboard-a-developer-ai-client.md#L69)). That sentence is the deliverable this story deletes.

Note the runbook also undercounts: it lists four platforms, the release publishes six.

### Source of truth (links)

- [ADR-0012 §4](https://github.com/ADORSYS-GIS/lightbridge-governance/blob/main/docs/adr/0012-governance-auth-packaging-and-distribution.md)
- [`release-governance-auth.yml`](https://github.com/ADORSYS-GIS/lightbridge-governance/blob/main/.github/workflows/release-governance-auth.yml) — where the upload step goes
- [`docs/runbooks/onboard-a-developer-ai-client.md`](https://github.com/ADORSYS-GIS/lightbridge-governance/blob/main/docs/runbooks/onboard-a-developer-ai-client.md) · [`docs/governance-auth/`](https://github.com/ADORSYS-GIS/lightbridge-governance/tree/main/docs/governance-auth)

### Acceptance Criteria

1. `install.sh` is attached to every release by `release-governance-auth.yml`, alongside the binaries.
2. `curl -fsSL https://github.com/ADORSYS-GIS/lightbridge-governance/releases/latest/download/install.sh` returns the script from the **newest** release. Verified against a real release, not asserted from documentation.
3. The **versioned** URL also resolves, so an image can pin the installer rather than always taking latest. Both forms are documented, with the difference stated — `latest/download` always serves newest, which is a footgun for a reproducible image build.
4. Runbook step 1 is the one-line command. The "There is no package manager entry yet" sentence is gone and the platform list is corrected to six.
5. `docs/governance-auth/README.md` gains an install section consistent with the runbook — one source of truth, cross-linked, not two drifting copies.
6. The `--proto '=https' --tlsv1.2` flags appear in every published copy of the command. They are the cheap part of the trust story and get dropped by copy-paste if the canonical form omits them.
7. The upload step is covered by the same tag-validation guard as the existing asset upload — the `workflow_dispatch` tag input is attacker-supplied and is already routed through an env var and pattern-checked for exactly this reason. A new `gh release upload` call that interpolates `${{ }}` directly reintroduces the injection the existing step took care to avoid.

### Out of Scope

- The script itself.
- Updating Coder workspace templates or dotfiles repos to consume it — separate repos, follow-on work; this story only makes it consumable.
- A vanity domain (`sh.governance…`). Nice, but it is DNS and a redirect to own; the releases URL works today.

### Dependencies and Blockers

- Depends on the installer story landing first.

### Assumptions

- GitHub's `releases/latest/download/` redirect stays stable. Widely relied on, but it is worth one real `curl` to confirm rather than assuming.

### Implementation Notes

- The upload can ride the existing `Attach to the release` step or be its own job. If its own: it must **not** run per-matrix-entry, or six jobs race to upload the same file. A single non-matrix job is the simpler shape.
- Docs-only parts of this change legitimately do not need `just all-checks`; say so in the PR's Verification section rather than ticking the box untruthfully.

### Test Expectations

- After the first release carrying it, actually run the documented command end-to-end on a clean machine. "The asset is listed" is not the same claim as "the documented command works".

### Verification evidence

To be filled by the implementing PR: the release page showing the asset, and a terminal transcript of the documented one-liner on a clean machine.

### Human accountable owner

@stephane-segning

### AI Usage Declaration

Drafting this story, Refining acceptance criteria, Suggesting implementation

### Human verification completed

Not yet.