Serve installer from get.valyu.ai

[yorkeccak]

What

• Install one-liners now use the dedicated install domain:
  • curl -fsSL https://get.valyu.ai | bash (macOS/Linux)
  • irm https://get.valyu.ai/install.ps1 | iex (Windows)
• New publish-installer workflow: when install.sh / install.ps1 change on main, uploads them to the install-scripts S3 bucket via GitHub OIDC (no stored credentials) and verifies the served content matches the repo byte-for-byte.
• Version bump to 1.2.2, fixing a version-drift bug: v1.2.1 binaries self-reported v1.2.0 because src/lib/version.ts is a hardcoded constant that wasn't bumped. sync-skill-version.mjs now syncs it from package.json alongside SKILL.md, and the npm version hook stages it.

Notes

• Nothing breaks: the raw.githubusercontent.com install URLs keep working - install.sh/install.ps1 in this repo remain the source of truth, and get.valyu.ai serves a synced copy. Binaries still come from GitHub Releases with sha256 verification, unchanged.
• The scripts are served with Cache-Control: no-cache, so fixes propagate immediately.
• The OIDC role is assumable only from this repo's main branch and can only write the two script objects.

Testing

• pnpm build && pnpm typecheck && pnpm test - 49/49 passing
• node dist/cli.cjs --version reports v1.2.2
• End-to-end verified: curl -fsSL https://get.valyu.ai | bash installs and runs (domain is already live, seeded with current main's scripts)

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}