feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

TEST-EXAMPLES.md

@@ -106,14 +106,14 @@ test('msd-tools reports the resolved config', (t) => {
 **Compliant — a genuinely distinct class: name it, and size it relative to what it wraps:**
 
 ```javascript
-const { NPM_VIEW_TIMEOUT_MS } = require('../msd-core/bin/check-latest-version.cjs');
+const { LOOKUP_TIMEOUT_MS } = require('../msd-core/bin/check-latest-version.cjs');
 
 // Real headroom beyond the inner timeout the worker itself is bounded by — not a
 // second independent guess. See TESTING-STANDARDS.md's "No ad hoc timeout literals".
 const WORKER_TEARDOWN_MARGIN_MS = 10_000;
 
 test('worker run leaves a valid cache', (t) => {
-  const r = runHookSeam(WORKER_PATH, [], { timeoutMs: NPM_VIEW_TIMEOUT_MS + WORKER_TEARDOWN_MARGIN_MS });
+  const r = runHookSeam(WORKER_PATH, [], { timeoutMs: LOOKUP_TIMEOUT_MS + WORKER_TEARDOWN_MARGIN_MS });
   assert.equal(r.exitCode, 0);
 });
 ```