feat: install and update msd from git release tags, not npm

MSD is not published to npm, so /msd-update and the SessionStart update
check could never find a release. Releases are now vX.Y.Z git tags plus a
stable branch:

- check-latest-version reads release tags via git ls-remote against the
  baked repository URL (latest = highest stable tag, next = incl. -rc)
- /msd-update reruns the bootstrap installer pinned to the checked tag and
  reads the changelog from that tag
- bootstrap.sh defaults to the stable branch and supports --local/--global
- package identity: changelog URL on stable, manual install via
  msd.golem15.com
- README quickstart and update how-to describe the one-line installer
- track the repo-root CLAUDE.md

Emitted-Drift-Ack-Growth: update.md — the update flow now explains the git-tag release lookup and pins the bootstrap installer to the checked tag, replacing the npm/npx wording

tests/package-identity.test.cjs

@@ -173,11 +173,11 @@ describe('Issue #498: deriveIdentity (pure, package.json -> coordinates)', () =>
     assert.equal(deriveIdentity(FAKE_PKG).repoUrl, 'https://github.com/acme/example-pkg');
   });
 
-  test('a git.golem15.com repository yields in-place raw URLs on the next branch', () => {
+  test('a git.golem15.com repository yields in-place raw URLs on the stable branch', () => {
     const id = deriveIdentity({ ...FAKE_PKG, repository: 'git+https://git.golem15.com/golem15/msd-core.git' });
     assert.equal(id.repoSlug, 'golem15/msd-core');
     assert.equal(id.repoUrl, 'https://git.golem15.com/golem15/msd-core');
-    assert.equal(id.changelogRawUrl, 'https://git.golem15.com/golem15/msd-core/raw/branch/next/CHANGELOG.md');
+    assert.equal(id.changelogRawUrl, 'https://git.golem15.com/golem15/msd-core/raw/branch/stable/CHANGELOG.md');
   });
 
   test('changelogRawUrl points at raw.githubusercontent main CHANGELOG', () => {
@@ -218,18 +218,18 @@ describe('Issue #498: slugifyPackageName (pure helper for cache filename)', () =
   });
 });
 
-describe('Issue #498: formatManualInstall (the npx fallback command)', () => {
-  test('global scope, no runtime -> npx with --global only', () => {
+describe('Issue #498: formatManualInstall (the bootstrap-installer fallback command)', () => {
+  test('global scope, no runtime -> bootstrap with --global only', () => {
     assert.equal(
       formatManualInstall({ packageName: '@scope/example-pkg', binName: 'example-pkg', scope: 'global' }),
-      'npx -y --package=@scope/example-pkg@latest -- example-pkg --global',
+      'curl -fsSL https://msd.golem15.com | bash -s -- --global',
     );
   });
 
   test('local scope with runtime -> --<runtime> before --<scope>', () => {
     assert.equal(
       formatManualInstall({ packageName: '@scope/example-pkg', binName: 'example-pkg', scope: 'local', runtime: 'claude' }),
-      'npx -y --package=@scope/example-pkg@latest -- example-pkg --claude --local',
+      'curl -fsSL https://msd.golem15.com | bash -s -- --claude --local',
     );
   });
 
@@ -237,7 +237,7 @@ describe('Issue #498: formatManualInstall (the npx fallback command)', () => {
     const id = deriveIdentity(require(path.join(ROOT, 'package.json')));
     assert.equal(
       formatManualInstall({ packageName: id.packageName, binName: id.binName, scope: 'global', runtime: 'claude' }),
-      'npx -y --package=@golem15/msd-core@latest -- msd-core --claude --global',
+      'curl -fsSL https://msd.golem15.com | bash -s -- --claude --global',
     );
   });
 });
@@ -269,7 +269,7 @@ describe('Issue #498: generated runtime module (baked)', () => {
     const id = require(GENERATED);
     assert.equal(
       id.manualInstallCommand({ scope: 'global', runtime: 'claude' }),
-      'npx -y --package=@golem15/msd-core@latest -- msd-core --claude --global',
+      'curl -fsSL https://msd.golem15.com | bash -s -- --claude --global',
     );
   });
 });