Feature: download/extract + manifest write (shared installer)

**Summary**
Build shared installer pipeline used by dist/tool/extension handlers.

**Scope**
- HTTP fetch of archive; extract to target directory.
- Write manifest as JSONC (`manifest.json` with comments allowed).
- Optional hash/integrity check per design.
- Idempotent install with `--force`/overwrite policy per design.
- Error handling/logging to stderr.

**Acceptance**
- Installer works for at least one sample payload (mock or fixture).
- Tests for download/extract + manifest write.
- Handler integration uses this pipeline.