feat: add exact online Linux install resolution

[kricha-lab-dev-worker]

Summary

• add exact-version online Linux release resolution for forge install --version vMAJOR.MINOR.PATCH
• authenticate immutable GitHub release/tag metadata and API SHA-256 asset digests before reusing the existing offline verifier
• hand off only fully verified assets to the exact target CLI with complete offline arguments
• preserve existing exact offline install/upgrade behavior
• add deterministic local-TLS coverage and disposable GitHub-hosted privileged online acceptance against immutable v0.1.6

Security boundary

• fixed canonical repository: 0k-lab/agent-forge
• no floating versions, environment proxies, credentials, configurable production origins, or non-HTTPS redirects
• bounded metadata/assets, strict host allowlist, duplicate metadata rejection, private trusted /tmp staging, deterministic cleanup
• exact annotated tag-to-commit and required asset name/ID/size/digest checks
• existing manifest, archive, VERSION, safe extraction, and binary identity checks complete before target CLI handoff
• no cryptographic attestation verification is claimed in this increment

Verification

• focused online tests, including rejection matrix and 20x stability
• go test -count=1 ./...
• go test -race -count=1 ./cmd/forge ./internal/linuxinstall
• go vet ./...
• go build ./...
• shell syntax, installer diagnostics self-test, workflow YAML parse, and git diff --check
• live immutable v0.1.6 GitHub resolver probe
• independent exact-tree security review

Refs #43