[ingvarch]

What changes

Every release has a checksums file, and the install guide did not say how to use it. docs/install.md gets a section "Check a download": the commands for Linux, macOS and Windows, what the check shows, and how to see that the macOS binary is signed and notarized.

• The commands use a glob in place of the version, as the rest of the page does.
• The issue suggested spctl --assess --type execute -v ./urga. For a bare command-line binary it prints rejected (the code is valid but does not seem to be an app), so the guide uses spctl --assess --type open --context context:primary-signature -v ./urga, which prints accepted and source=Notarized Developer ID.

Run against the v0.18.1 release (darwin_arm64, linux_amd64 and windows_amd64 archives with the checksums file), as written in the guide:

• shasum -a 256 --check --ignore-missing urga_*_checksums.txt: OK for each of the three; with one byte added to an archive it prints FAILED and exits 1.
• sha256sum --check --ignore-missing urga_*_checksums.txt: OK for each, with the sha256sum of macOS. The GNU coreutils one of Linux was not run here; it has --ignore-missing since coreutils 8.25.
• spctl ... ./urga in the unpacked darwin_arm64 archive: ./urga: accepted, source=Notarized Developer ID.
• The PowerShell commands were not run: there is no PowerShell on this machine.

Issues

Closes #202

Checklist

• The test for this change was written first and failed
• make check is green
• The guide in docs/ is updated if users see a difference
• The title is a conventional commit: feat(ui): ..., fix(nomad): ...