[Improvement] Generate site/install at release time instead of copy-plus-drift-test

[splaice]

Observation

boot.sh and site/install are kept identical by convention ("edit boot.sh, run cp boot.sh site/install") with a test failing on drift. That works, but it converts every bootstrap change into a two-file edit with a tripwire, and three of the currently-planned changes (#6 version gate, #7 clone path, #9 installer pinning) all touch it. The copy exists only because the website serves a static file from the repo.

Proposal

Once #9's release process exists (RELEASING.md, tags), fold this in: site/install becomes a build artifact produced at release time (a one-line make/just step: cp boot.sh site/install) rather than a tracked twin — or the site serves boot.sh directly (a redirect/symlink at the webhost, removing the second copy entirely). Either way the drift class disappears instead of being tested for. Keep the sync test until then.

Scope

Future release; sequenced after #9. Simplicity.

🤖 Generated with Claude Code

[splaice]

Implementation plan

Self-contained; needs only this comment and the repo. Sequenced after #9 (which introduces RELEASING.md and tagged releases).

Background

boot.sh and site/install are identical twins by convention: "edit HERE and run cp boot.sh site/install; tests/run.sh fails on drift." Every bootstrap change is a two-file edit with a tripwire, and #6/#7/#9 all touch it. The copy exists only because the website serves a static file from the repo.

Decision for the maintainer (pick in the PR; plan covers both)

Option A (recommended): release script owns the copy. Introduce scripts/release.sh implementing #9's release ritual as one command: verify clean tree on main → bump VERSION (arg) → cp boot.sh site/install → run bash tests/run.sh → commit → git tag -a v<ver> → git push --follow-tags. RELEASING.md shrinks to "run scripts/release.sh <version>". The sync test STAYS (it is what makes the script trustworthy); drift becomes impossible in practice because no human runs cp by hand anymore. Day-to-day boot.sh edits no longer touch site/install at all — it only moves at release time, which also means the served installer always corresponds to a tagged release (a small #9 security win: the public entry point never serves unreleased main).

Option B: eliminate the copy. The webhost serves boot.sh directly (redirect or symlink from /install to the raw tagged boot.sh). Repo deletes site/install + the sync test + the cp convention. Cleanest, but moves correctness into webhost config the repo can't test — only choose this if the host supports pinning /install to the latest release tag (serving raw main would regress #9).

Changes (Option A)

1. scripts/release.sh per above — shellcheck-clean bash, set -euo pipefail, refuses to run off-main or with a dirty tree, prints the tag it made.
2. RELEASING.md: replace the manual ritual with the script (keep the manual steps as an appendix for recovery).
3. boot.sh header comment: "edit HERE; site/install is refreshed by scripts/release.sh at release time" (drop the "run cp yourself" instruction).
4. CI shellcheck list gains scripts/release.sh.
5. Sync test: unchanged in mechanism, but reword its failure message to "run scripts/release.sh (or cp boot.sh site/install) before tagging" — mid-cycle drift between releases is now EXPECTED on main. Therefore also change the test to compare only when VERSION's tag exists on HEAD? No — simpler rule, keep byte-equality enforced on every commit; the release script just becomes the thing that restores it, and boot.sh edits still cp immediately. (Judgement call: strict-always is simpler and keeps the public installer fresh; note both readings in the PR and implement strict-always.)

Tests

1. test_release_script_syncs_site_install: run scripts/release.sh --dry-run <ver> (add a --dry-run that does everything except commit/tag/push, operating on a temp clone of the repo) → temp clone's site/install equals its boot.sh, VERSION bumped, no tag created.
2. Existing sync test stays as-is.

Verification / done criteria

Suite green; shellcheck clean. Manual: scripts/release.sh --dry-run 99.0.0 in a scratch clone behaves as specified. Do NOT cut a real release as part of this PR unless #9's stable channel is already live.

Branch + PR; body says Closes #21.