Ship a prebuilt evsieve binary (Release asset) with build-at-install fallback

[aradanmn]

Idea

Ship a prebuilt evsieve binary (as a GitHub Release asset, SHA-pinned) that the
installer downloads, instead of always compiling from source in a distrobox. Build-at-
install is slow (multi-minute cargo build), fragile (distrobox/podman/apt/network deps;
the sudo/TTY hang in #124), and a rough first-run UX.

Why it's currently build-at-install (the constraints to respect)

• GPL-2.0 (the main reason). evsieve is GPL; the design keeps it a source island
  (pinned clone + our patch, third_party/evsieve/) so a GPL binary isn't bundled with
  the project's own (license-unresolved, License resolution (DECISION-4) — the distribution blocker #33) code. Shipping a binary is allowed under
  GPL if the corresponding source + build instructions + license accompany it — and
  the repo already carries that material. But public distribution of anything is gated
  on License resolution (DECISION-4) — the distribution blocker #33 regardless.
• Host ABI compat. evsieve links libevdev.so.2 (+ glibc) dynamically; building on
  the target and _evsieve_host_verify-ing it guarantees it runs on that SteamOS build.
  A prebuilt binary can skew across SteamOS/glibc updates.

Proposed design (best of both)

1. Publish a prebuilt binary as a Release asset (SHA-pinned), built against the SteamOS
   runtime (consider statically linking libevdev to kill the ABI skew).
2. Installer: download it → _evsieve_host_verify it actually runs → use it.
3. Fall back to the existing build-at-install if the download fails or the binary
   won't run on this host. The host-verify gate already exists, so the fallback is safe.

Fast + reliable common path, robust fallback, GPL-compliant (source in-repo). Gated on
#33 for public distribution; usable on the fork sooner.

Related

#38 (evsieve), #33 (license/distribution), #124 (the build hang this would largely
sidestep).