Make the installer launchers robust

[SaladDay]

What

• deploy/install.sh: parses --version TAG / --version=TAG without copying "$@" (fixes the bash < 4.4 / macOS 3.2 no-argument abort that exited 0), rejects a dangling --version, downloads with a 5-attempt loop (--continue-at -, stall limit instead of a total cap, no --retry-all-errors), progress bar in a terminal, Release <tag> not found on 404, one network message with the next step, mktemp -d "${TMPDIR:-/tmp}/oac.XXXXXX", deletes the file on checksum mismatch. OAC_REPOSITORY removed (no caller in tests, CI or docs).
• website/install.sh: same retry loop and message, still a thin forwarder.
• deploy/install.ps1: body runs in its own scope so & ([scriptblock]::Create((irm <url>))) <flags> works, same retry loop, --version=TAG, $ProgressPreference='SilentlyContinue', Write-Error plus non-zero exit (exits only when run as a file, so an interactive session stays open); OAC_REPOSITORY removed.
• scripts/build-core-distribution.sh: -s -w on the oac ldflags. Linux amd64 size 9,567,095 -> 6,623,394 bytes.
• native.yml: deploy/test_install.py and website/tests/install.test.mjs run on the macOS/Linux jobs with /bin/bash; test_install.ps1 runs under pwsh and Windows PowerShell 5.1.
• Docs (EN + zh, hashes refreshed): script-block command for Windows flags in install-options, operations Upgrade; install.md links to it.

Why

Audit-core findings 1, 2 (launcher, binary size), 9, P2 b, k, l (launcher part), o (TMPDIR).

Verification

• python3 -m unittest deploy.test_install pass; the same test with bash 3.2.57 and 4.2.53 builds pass.
• node --test website/tests/install.test.mjs pass.
• test_install.ps1 under pwsh 7 (Linux) pass; pwsh -File install.ps1 --version exits 1, script block call leaves the session alive.
• check-names.py, bash -n pass.

Skipped

• Windows PowerShell 5.1 locally (no Windows host): covered by the native.yml windows job.
• translations.test.mjs test 3 (needs vitepress, fails identically without this change).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}