feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

docs/how-to/update-msd.md

@@ -2,7 +2,7 @@
 
 Update an existing MSD Core install to the latest release, preview the changelog before committing, and recover any local customisations that the update would overwrite.
 
-**What you need:** The same runtime MSD is installed for. The update command re-runs the installer under the hood, so it needs Node.js and npx available (same requirement as the original install).
+**What you need:** The same runtime MSD is installed for. The update command re-runs the installer under the hood, so it needs Node.js 24+, git and curl available (same requirement as the original install).
 
 ---
 
@@ -17,11 +17,11 @@ From inside your AI runtime, run:
 MSD will:
 
 1. Detect the installed version and install scope (global or local).
-2. Check npm for the latest release of `@golem15/msd-core`.
+2. Check the MSD repository's release tags (`vX.Y.Z`) for the latest release.
 3. Fetch the changelog and show you what changed between your installed version and the latest.
 4. Ask for confirmation before touching anything.
 5. Back up any user-added files found inside MSD-managed directories to `msd-user-files-backup/`.
-6. Run the installer (`npx @golem15/msd-core@latest --<runtime> --<scope>`).
+6. Run the bootstrap installer pinned to that release (`curl -fsSL https://msd.golem15.com | bash -s -- --ref vX.Y.Z --<runtime> --<scope>`).
 7. Clear the update-check cache so the statusline indicator resets.
 8. Offer to restore the user-added files it backed up in step 5.
 9. Report whether locally modified MSD files were backed up to `msd-local-patches/`.
@@ -46,19 +46,19 @@ Restart your runtime after a successful update to pick up new commands and agent
 |------|--------------|
 | `--sync` | After updating, sync skills from the MSD registry |
 | `--reapply` | After updating, merge locally modified MSD files back in from `msd-local-patches/` |
-| `--next` / `--rc` | Target the `@next` RC dist-tag instead of `@latest` (installs or refreshes a release candidate; see ADR #660) |
+| `--next` / `--rc` | Also consider prerelease tags (`vX.Y.Z-rc.N`), so a release candidate can be installed or refreshed (see ADR #660) |
 
 ```bash
 /msd-update --sync        # Update and sync skills
 /msd-update --reapply     # Update and reapply local patches
-/msd-update --next        # Install from the @next RC dist-tag
+/msd-update --next        # Include release candidates
 ```
 
 ---
 
 ## Install or refresh a release candidate
 
-MSD publishes release candidates on the `@next` npm dist-tag (established by ADR #660). To install or refresh from that channel:
+MSD publishes release candidates as prerelease tags such as `v2.1.0-rc.1` (the RC channel established by ADR #660). To install or refresh from that channel:
 
 ```bash
 /msd-update --next
@@ -66,11 +66,11 @@ MSD publishes release candidates on the `@next` npm dist-tag (established by ADR
 /msd-update --rc
 ```
 
-The full update flow applies — scope/runtime detection, changelog preview, custom-file backup, and cache clearing all run normally. The only difference is that `check-latest-version.cjs` resolves the `@next` tag and npx installs from `@golem15/msd-core@next`.
+The full update flow applies — scope/runtime detection, changelog preview, custom-file backup, and cache clearing all run normally. The only difference is that `check-latest-version.cjs` also counts prerelease tags when it picks the latest version, and the installer is pinned to that tag.
 
-Only `latest` and `next` are supported channels; no arbitrary dist-tag can be passed (the script enforces an allowlist and exits with code 2 on an invalid tag).
+Only `latest` and `next` are supported channels; no arbitrary channel can be passed (the script enforces an allowlist and exits with code 2 on an invalid tag).
 
-Omitting `--next`/`--rc` keeps targeting `@latest` (stable channel, no change in behavior).
+Omitting `--next`/`--rc` targets the highest stable `vX.Y.Z` tag.
 
 ---
 
@@ -95,7 +95,7 @@ Latest:    1.41.0
 Proceed with update? [Yes, update now / No, cancel]
 ```
 
-If the changelog cannot be fetched (no network access, npm outage), the update still proceeds after confirmation — it does not block on changelog availability.
+If the changelog cannot be fetched (no network access, forge outage), the update still proceeds after confirmation — it does not block on changelog availability.
 
 ---
 
@@ -151,9 +151,9 @@ It is safe to run `--reapply` on its own without triggering a new download — i
 
 ---
 
-## When npm is unavailable
+## When the installer is unavailable
 
-If `npx @golem15/msd-core@latest` fails due to an npm outage, network restrictions, or because you are working from the source repository, use the manual update procedure in [docs/manual-update.md](../manual-update.md). That document covers pulling the latest commit, building the hooks dist, and running `node bin/install.js` directly.
+If the bootstrap installer fails due to an outage, network restrictions, or because you are working from the source repository, use the manual update procedure in [docs/manual-update.md](../manual-update.md). That document covers pulling the latest commit, building the hooks dist, and running `node bin/install.js` directly.
 
 ---