Harden agent CLI bootstrap guidance

[TerminallyLazy]

Summary

• replace agent-facing curl-pipe bootstrap examples with a version-pinned, SHA-256-verified installer flow
• preserve exact project-root init and scope-preserving update instructions
• release the generated guidance as CLI v0.15.1

Validation

• 499 Rust tests pass
• strict Clippy and formatting pass
• full certification suite passes
• canonical skills and plugin packages validate
• HOL plugin scanner reproduces at 97/100 with no high-severity findings

High-level PR Summary

This PR hardens the bootstrap installation process for AI agents by replacing the insecure curl | sh pattern with a security-critical flow that requires downloading a version-pinned installer (v0.15.0/install.sh), verifying its SHA-256 checksum (ef0d5eb8f09cbe2e4c3abe80ee9a98a56759c89ad4ddd103d6c68314cd653ade), and inspecting it before execution. All agent-facing documentation, skill files, and templates are updated with this hardened guidance, and the CLI version is bumped to 0.15.1 to reflect these security improvements.

⏱️ Estimated Review Time: 30-90 minutes

💡 Review Order Suggestion

Order	File Path
1	Cargo.toml
2	Cargo.lock
3	crates/tree-ring-memory-cli/Cargo.toml
4	crates/tree-ring-memory-sqlite/Cargo.toml
5	crates/tree-ring-memory-cli/src/agent_awareness.rs
6	templates/dox/AGENTS.md
7	skills/tree-ring-memory/SKILL.md
8	plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md
9	plugins/tree-ring-memory/README.md
10	docs/integrations/agent-skill.md
11	README.md
12	docs/press-kit.md
13	marketing/README.md

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

Warning

Review limit reached

Next included review available in 25 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7f382af7-4ada-4b85-aa48-4a65231d32e9

📥 Commits

Reviewing files that changed from the base of the PR and between 4027d37 and d05d78a.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (12)

• Cargo.toml
• README.md
• crates/tree-ring-memory-cli/Cargo.toml
• crates/tree-ring-memory-cli/src/agent_awareness.rs
• crates/tree-ring-memory-sqlite/Cargo.toml
• docs/integrations/agent-skill.md
• docs/press-kit.md
• marketing/README.md
• plugins/tree-ring-memory/README.md
• plugins/tree-ring-memory/skills/tree-ring-memory/SKILL.md
• skills/tree-ring-memory/SKILL.md
• templates/dox/AGENTS.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}