setup.sh: pin cargo-binstall by version and digest, not curl|bash of main

[lann]

scripts/setup.sh piped cargo-binstall's install-from-binstall-release.sh from the upstream repo's main branch straight into bash — the one unpinned, unverified execution path in a script where every other tool is version-pinned.

Now install_binstall downloads the v1.21.1 release asset for the host platform directly (no bootstrap script), verifies it against the committed scripts/cargo-binstall.sha256, and fails closed on a digest mismatch or an unrecorded asset — the pattern js/componentize/wpt/component.sh set. Platforms without a pinned asset fall back to cargo install --locked --version (registry checksums). Bumping the version means re-recording the digests deliberately.

Verification:

• the three pinned digests match the GitHub release API's published digests for v1.21.1 (the current latest), independently recomputed from downloaded assets
• happy path exercised for real on Linux/aarch64: the binary lands executable in ~/.cargo/bin and reports 1.21.1; this PR's own CI exercises the x86_64 path, since both jobs run ./scripts/setup.sh
• tamper test: a flipped digest exits 1 with the diagnostic and installs nothing; a missing pin for the host asset likewise fails closed
• archive layouts checked against the extraction commands: single root-level member; the darwin zip carries mode 0755, so unzip restores the exec bit
• shellcheck v0.11.0 clean

Fixes #29.