feat!: installation only from a release, into an empty folder; upstream merge/verify and private-instance.md removed, dist adopt, shell-neutral instructions (#153)

Files changed:
- .gitea/workflows/ci.yml
- .gitea/workflows/release.yml
- AGENTS.md
- CHANGES.md
- DEVELOPMENT.md
- EVALS.md
- INSTALL.md
- README.md
- VERSION
- docs/ownership-and-templates.md
- instructions/CONTRACT.md
- instructions/bootstrap.md
- instructions/dev/dev-setup.md
- instructions/dev/stack-dev/SKILL.md
- instructions/gates.md
- instructions/ingest-large-tree.md
- instructions/kb-profiles.md
- instructions/mcp-read-server.md
- instructions/migrations/3.0.0-authoring-conventions.md
- instructions/preflight.md
- instructions/private-instance.md
- instructions/session-setup.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/upstream_cmd.py
- tools/chemenu/commands/work_cmd.py
- tools/chemenu/config.py
- tools/chemenu/ownership.py
- tools/chemenu/tests/test_cli.py
- tools/chemenu/tests/test_dist_cmd.py
- tools/chemenu/tests/test_instructions_shell.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/tests/test_run_budget.py
- tools/chemenu/tests/test_upstream_cmd.py
- tools/chemenu/toc.py
- tools/preflight.ps1
- tools/preflight.sh

instructions/preflight.md

@@ -100,16 +100,19 @@ It is safe to run at any time: a second run on a ready checkout changes nothing
 ## Decision points
 
 - **The script is a release asset, not a tree script** - there is no `tools/prerequisites.txt`
-  beside it, because the user downloaded `preflight.sh` or `preflight.ps1` from a release page
-  into an empty folder. That is the *first* install, and the script does one more thing before
-  the steps above: it downloads the release tarball and its `.sha256`, refuses unless the
-  checksum matches, and unpacks into a `chemenu/` folder next to itself; then it runs the
-  preflight of the unpacked tree, passing `--set` and its exit code through. Run it exactly as
-  in step 1 (the path is the downloaded file, not `tools/...`), and read the exit code the same
-  way. After it, every later run - including the retry after an exit 42 - is the tree's own
-  `tools/preflight.sh` or `tools/preflight.ps1`, run from inside `chemenu/`.
-  - `--into <path>` unpacks somewhere else; an existing target is refused with exit 1 and
-    nothing is touched, which is the user's decision to make, not yours to resolve by deleting.
+  beside it, because it was downloaded from a release into the empty folder the wiki is to live
+  in ([setup-instance.md](setup-instance.md) step 0). That is the *first* install, and the
+  script does one more thing before the steps above: it downloads the release tarball and its
+  `.sha256`, refuses unless the checksum matches, unpacks the stack into its own folder and
+  removes itself there; then it runs the preflight of the installed tree, passing `--set` and
+  its exit code through. Run it exactly as in step 1 (the path is the downloaded file, not
+  `tools/...`), and read the exit code the same way. After it, every later run - including the
+  retry after an exit 42 - is the tree's own `tools/preflight.sh` or `tools/preflight.ps1`.
+  - The folder has to be empty apart from the script and a `.git` (an empty clone of the
+    instance's own repository). Anything else is refused with exit 1 and nothing is touched -
+    which folder to use is the user's decision, not yours to resolve by deleting.
+  - `--into <path>` installs into another folder, under the same rule; the script then stays
+    where it is.
   - `--archive <tarball>` uses a tarball already on disk, with its `<tarball>.sha256` beside it,
     when the machine cannot download.
   - A checksum that does not match, a failed download, and a copy of the script that carries no
@@ -122,7 +125,8 @@ It is safe to run at any time: a second run on a ready checkout changes nothing
   install folder may be at most 95 characters, because every file of the wiki below it has to
   stay within 259. Moving the wiki to a shorter folder is the user's step; do not try to shorten
   paths inside the wiki instead. In asset mode the length is judged at the folder the stack
-  *would* be unpacked into, before anything is unpacked; the fix is a shorter `--into`.
+  *would* be unpacked into, before anything is unpacked; the fix is a shorter folder (the
+  script downloaded there again, or a shorter `--into`).
 - **The output names the PowerShell execution policy** (`Restricted` or `AllSigned`). The fix is a
   line the user runs in a PowerShell 7 window; it changes a setting of their account, so it is
   theirs to run. When a *group policy* sets it, nothing on this computer can override it: the