feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

scripts/bootstrap.sh

@@ -4,8 +4,10 @@
 #   curl -fsSL https://msd.golem15.com | bash
 #   curl -fsSL https://msd.golem15.com | bash -s -- --codex --profile standard
 #
-# Clones (or updates) the MSD checkout into $MSD_HOME, builds it, and runs
-# bin/install.js globally for the chosen runtime(s). Installs Claude Code
+# Clones (or updates) the MSD checkout into $MSD_HOME at the `stable` branch
+# (the latest tagged release), builds it, and runs bin/install.js for the
+# chosen runtime(s) — globally by default, or into the current directory with
+# --local. Installs Claude Code
 # first when it is the target runtime and `claude` is not on PATH.
 #
 # Everything lives inside main() so a truncated download never runs half a script.
@@ -14,10 +16,12 @@ main() {
   set -euo pipefail
 
   local repo="${MSD_REPO:-https://git.golem15.com/golem15/msd-core.git}"
-  local ref="${MSD_REF:-next}"
+  local ref="${MSD_REF:-stable}"
   local home_dir="${MSD_HOME:-$HOME/.local/share/msd-core}"
   local profile="${MSD_PROFILE:-full}"
   local install_claude=true
+  local scope=--global
+  local start_dir="$PWD"
   local runtimes=()
 
   while (($#)); do
@@ -34,6 +38,7 @@ main() {
         (($#)) || { echo "ERROR: --ref requires a value." >&2; exit 2; }
         ref="$1"
         ;;
+      --global|--local) scope="$1" ;;
       --skip-claude-install) install_claude=false ;;
       -h|--help)
         cat <<'EOF'
@@ -45,7 +50,10 @@ Options:
   --claude, --codex, --opencode, --cursor, --zcode, --antigravity
                          Runtime(s) to install for (default: --claude)
   --profile NAME         Skill profile: core, standard or full (default: full)
-  --ref REF              Branch or tag to install (default: next)
+  --ref REF              Branch or tag to install (default: stable, the
+                         latest release; e.g. v2.0.0, or next for unreleased work)
+  --global | --local     Install into the runtime's home config (default) or
+                         into the current directory's project config
   --skip-claude-install  Do not install Claude Code when it is missing
 
 Environment: MSD_HOME (checkout dir, default ~/.local/share/msd-core),
@@ -111,14 +119,15 @@ EOF
   npm run --silent build:hooks
 
   local rt
+  cd "$start_dir"
   for rt in "${runtimes[@]}"; do
-    say "Installing MSD for ${rt#--} (profile: $profile)"
-    node bin/install.js "$rt" --global "--profile=$profile"
+    say "Installing MSD for ${rt#--} (${scope#--}, profile: $profile)"
+    node "$home_dir/bin/install.js" "$rt" "$scope" "--profile=$profile"
   done
 
   cat <<EOF
 
-MSD installed from $home_dir ($(git rev-parse --short HEAD)).
+MSD installed from $home_dir ($(git -C "$home_dir" describe --tags --always)).
 Update any time by rerunning:  curl -fsSL https://msd.golem15.com | bash
 EOF
   if [[ " ${runtimes[*]} " == *" --claude "* ]] && ! command -v claude >/dev/null 2>&1; then

scripts/generate-package-identity.cjs

@@ -31,13 +31,14 @@ function parseRepoSlug(repository) {
 }
 
 /**
- * Raw-file URL for CHANGELOG.md on the repo's default branch. GitHub serves raw
- * files from a separate host; the golem15 Gitea forge serves them in-place.
+ * Raw-file URL for CHANGELOG.md on the release branch. GitHub serves raw files
+ * from a separate host; the golem15 Gitea forge serves them in-place from the
+ * `stable` branch, which always points at the latest tagged release.
  */
 function changelogRawUrlFor(host, slug) {
   if (!slug) return '';
   if (host === 'github.com') return `https://raw.githubusercontent.com/${slug}/main/CHANGELOG.md`;
-  return `https://${host}/${slug}/raw/branch/next/CHANGELOG.md`;
+  return `https://${host}/${slug}/raw/branch/stable/CHANGELOG.md`;
 }
 
 /**
@@ -70,16 +71,18 @@ function deriveIdentity(pkg = {}) {
 }
 
 /**
- * Pure: format the `npx` fallback install command. Shape matches the literal
- * the update workflow embeds: `npx -y --package=<pkg>@latest -- <bin>
+ * Pure: format the manual install command. MSD is not published to npm; it is
+ * installed by the bootstrap script served at msd.golem15.com
+ * (scripts/bootstrap.sh on the `stable` branch). Shape matches the literal the
+ * update workflow embeds: `curl -fsSL https://msd.golem15.com | bash -s --
  * [--<runtime>] --<scope>`. The runtime flag is omitted when not supplied.
  *
  * This function is the canonical source — `render()` serializes it verbatim
  * into the generated module, so the runtime copy can never drift from it.
  */
-function formatManualInstall({ packageName, binName, scope, runtime } = {}) {
+function formatManualInstall({ scope, runtime } = {}) {
   const runtimeFlag = runtime ? ` --${runtime}` : '';
-  return `npx -y --package=${packageName}@latest -- ${binName}${runtimeFlag} --${scope}`;
+  return `curl -fsSL https://msd.golem15.com | bash -s --${runtimeFlag} --${scope}`;
 }
 
 const GENERATED_HEADER =
@@ -107,7 +110,7 @@ function render(identity) {
     `const updateCacheFileName = ${j(updateCacheFileName)};\n\n` +
     `${formatManualInstall.toString()}\n\n` +
     'function manualInstallCommand(opts = {}) {\n' +
-    '  return formatManualInstall({ packageName, binName, scope: opts.scope, runtime: opts.runtime });\n' +
+    '  return formatManualInstall({ scope: opts.scope, runtime: opts.runtime });\n' +
     '}\n\n' +
     'module.exports = Object.freeze({\n' +
     '  packageName,\n' +