Add installer GPG verification

[Widthdom]

Summary

• Add GPG verification for sha256sums.txt.asc in install.sh when GnuPG is available.
• Add --strict-verify / CDIDX_STRICT_VERIFY=1 fail-closed mode and CDIDX_RELEASE_GPG_FINGERPRINT signer pinning.
• Document installer signature verification and add a bilingual security changelog fragment.

Validation

• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~InstallScriptTests" -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-build
• git diff --check

Documentation and changelog

• Updated README.md installation security notes in English and Japanese.
• Added changelog.d/unreleased/1795.security.md.

Follow-up candidates

• Publish the official CodeIndex release signing public key and fingerprint so production one-liners can pin it without caller-provided CDIDX_RELEASE_GPG_FINGERPRINT.

Fixes #1795