ci: install just in the webkit jobs via the pinned binstall bootstrap

[lann]

The two wpt-parity-webkit jobs installed just by piping just.systems/install.sh into bash — version-pinned (--tag 1.54.0) but a floating, unverified script (it has no checksum logic), the same shape #342 removed from setup.sh.

The old comment's justification — "this job skips the Rust toolchain, so it cannot use setup.sh's cargo-binstall path" — is empirically false: cargo-binstall's prebuilt strategy needs no cargo. So setup.sh's digest-verified bootstrap moves to scripts/install-binstall.sh (byte-for-byte the same block, plus the idempotence guard), shared by setup.sh and the two webkit steps, which now run it and then cargo-binstall --no-confirm --disable-strategies compile --install-path ~/.local/bin just@1.54.0 — compile fallback disabled, so a missing toolchain fails closed instead of being assumed.

Scope note: just's own release bytes remain trusted via crates.io metadata + GitHub TLS, exactly like every other binstall-installed tool (wasm-tools, wac, wasmtime); byte-pinning tool artifacts is the still-open half of #34's checklist. This PR removes the mutable-script layer and unifies the fleet on one verified bootstrap.

Verification:

• CI-step replica in a scrubbed env (no cargo/rustup on PATH, fresh HOME): install-binstall.sh installs the digest-verified 1.21.1, then binstall installs just 1.54.0 into ~/.local/bin in ~2s
• idempotence: second run reports "already present" and touches nothing
• tamper test against the extracted script: flipped digest exits 1 with the diagnostic, nothing installed
• shellcheck clean (both scripts); actionlint (with shellcheck integration) reports no new findings — the one info-level SC2016 hit predates this change on main
• setup.sh path re-exercised by this PR's own CI (four jobs run it)