[codex] Verify upgrade installer checksum

[Widthdom]

Summary

• Publish install.sh as a release asset so sha256sums.txt covers the installer script.
• Make cdidx upgrade download release sha256sums.txt, verify the install.sh SHA-256 entry, and only then execute the installer.
• Document the checksum trust boundary and add a security changelog fragment.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ProgramRunnerTests"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• dotnet test ran on final HEAD: net8 passed; net9 had one unrelated ExtractorPluginRegistryTests.LoadPluginAssemblies_RetainsCapDiagnosticWhenCandidatesAlsoFailToLoad Regex timeout. The failing test passed when rerun directly with the same filter on net8/net9.

Documentation and Changelog

• Updated README.md.
• Added changelog.d/unreleased/3004.security.md.

Review

• Adversarial review: No blocking/actionable issues found.

Fixes #3004