feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

hooks/msd-check-update-worker.js

@@ -51,8 +51,9 @@ try {
   ensureRuntimeBuild();
   ({ isSemverNewer } = require('../msd-core/bin/lib/semver-compare.cjs'));
   // Latest-version lookup is delegated to the single deterministic adapter
-  // (#498). checkLatestVersion() owns the npm-view call, the timeout/semver
-  // policy, and the package name — sourced from the baked Package Identity seam.
+  // (#498). checkLatestVersion() owns the release-tag lookup (git ls-remote),
+  // the timeout/semver policy, and the repository URL — sourced from the baked
+  // Package Identity seam.
   // The previous `require('../package.json').name` (#378) never yielded a name in
   // the installed tree — at the time it resolved to the synthetic
   // {"type":"commonjs"} marker MSD wrote at the config root, which has no `.name`,
@@ -136,9 +137,9 @@ if (configDir) {
   } catch (e) {}
 }
 
-// Single adapter for the registry lookup (#498). checkLatestVersion() routes
-// through the shell-projection seam, which already owns the Windows shell-flag
-// policy, the timeout, and semver validation. A non-ok result leaves latest
+// Single adapter for the release lookup (#498). checkLatestVersion() routes
+// through the shell-projection seam, which already owns the non-interactive git
+// env and the timeout; it also owns the semver validation. A non-ok result leaves latest
 // null, exactly as the previous inline try/catch did.
 let latest = null;
 try {