feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

eslint-rules/no-adhoc-timeout-literal.cjs

@@ -25,7 +25,7 @@ const path = require('path');
  * fired, the outer one could SIGKILL the whole process tree at the exact
  * same instant before it could degrade gracefully: a zero-margin race that
  * failed specifically on Windows CI (fixed in PR #4428 by extracting a named
- * `NPM_VIEW_TIMEOUT_MS` constant and referencing it with an explicit
+ * `LOOKUP_TIMEOUT_MS` constant and referencing it with an explicit
  * margin). This rule closes the gap CONTRIBUTING.md already documents:
  * "A non-literal value (`timeout: GIT_TIMEOUT_MS`) is trusted — that is the
  * shape you should be writing" — by actually enforcing that shape.