Pin cargo-binstall by version and digest, not curl|bash of main

[lann]

scripts/setup.sh piped cargo-binstall's install-from-binstall-release.sh from the upstream repo's main branch straight into bash — the one unpinned, unverified execution path in a script where every other tool is version-pinned and every sibling checkout under .deps/ is rev-pinned.

Now install_binstall downloads the v1.21.1 release asset for the host platform directly (no bootstrap script), verifies it against the committed scripts/cargo-binstall.sha256, and fails closed on a digest mismatch or an unrecorded asset. Platforms without a pinned asset fall back to cargo install --locked --version (registry checksums). Bumping the version means re-recording the digests deliberately. Ported from polymorph-components/polymorph-websocket#30; the digest file is byte-identical.

Verification:

• the three pinned digests match the GitHub release API's published digests for v1.21.1 (the current latest), independently recomputed from downloaded assets
• happy path exercised for real on Linux/aarch64 against this script: the binary lands executable in ~/.cargo/bin and reports 1.21.1; this PR's own CI exercises the x86_64 path, since the ci job runs ./scripts/setup.sh
• tamper test against this script: a flipped digest exits 1 with the diagnostic and installs nothing
• archive layouts checked against the extraction commands: single root-level member; the darwin zip carries mode 0755, so unzip restores the exec bit
• shellcheck v0.11.0 clean

Fixes #22.