fix: realign hyperi-update with how tools install

[catinspace-au]

hyperi-update now refreshes only what nothing at the OS level refreshes, and it checks every download before it touches /usr/local/bin.

• One refetch helper replaces the three old ones. It handles per-arch asset names, Gitea and plain HTTPS hosts (tea, macbash), tar, nested tar and zip.
  • Each download is checked against the sha256 GitHub publishes for the asset, or the project's checksum file where that is missing. A mismatch keeps the old binary and fails the run.
  • The new binary is placed with a rename, so a running build never sees half a file.
  • It acts only when /usr/local/bin/ is ours, so a copy from a package or ~/.local/bin is left alone.
  • The release and ETag are cached, so an unchanged release is not downloaded again.
• Newly refreshed:
  • lazygit, actionlint, osv-scanner, git-scrub, sccache, fnm, tea and macbash;
  • aws-vault, and kubectx on Fedora, both only taking releases at least 7 days old, as the roles do;
  • hadolint, gitleaks and act on Ubuntu, and sd on Fedora;
  • uv and uvx on Ubuntu, in ~/.local/bin as the user;
  • Go tools in ~/go/bin, rebuilt when the tool or the Go toolchain moves;
  • pnpm globals (--latest, because the role installs them unpinned);
  • uv's Python patch releases.
• gron is the one release binary left out, because upstream has been dormant since 2022.
• A replaced sccache stops its old server, so the next build starts the new one.
• Removed: macOS claude update, which does nothing for the cask that brew upgrade --cask --greedy already covers.
• Hardening:
  • curl timeouts;
  • the token is sent to api.github.com through a 0600 header file, and child processes no longer inherit it;
  • the exit cleanup ignores values inherited from the environment;
  • the macOS script's set -u and pipefail work again, since emulate -L zsh was resetting both.
• Anonymous GitHub API calls are capped at 60/h per IP, and anonymous 304s count against that. When the API refuses, the last cached release is used and the run stays green.

Tested on ubuntu:24.04, ubuntu:26.04 and fedora:44 against real release assets:

• every tool was replaced from a stand-in, and the second run reported each one current;
• a tampered asset was rejected with the old binary kept;
• a copy in ~/.local/bin and a symlink at /usr/local/bin/yq were left alone;
• the uv user refresh went 0.11.0 to 0.12.23;
• a Go toolchain bump rebuilt govulncheck;
• an old sccache server was stopped after replacement;
• test-hyperi-update.sh passed 18 of 18.

Not run: arm64, a real GitHub token, the systemd user unit restart, and macOS beyond zsh -n and --help.

Done when a weekly run on any supported box refreshes each tool exactly once, from a verified download, without adding a second copy.