feat: preflight as a release asset - download, verify, unpack, then run the tree preflight (#151, C)

Files changed:
- .gitea/workflows/release.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- instructions/dev/testing-conventions.md
- instructions/preflight.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/preflight.ps1
- tools/preflight.sh

instructions/preflight.md

@@ -68,7 +68,7 @@ It is safe to run at any time: a second run on a ready checkout changes nothing
    |---|---|---|
    | 0 | Everything is in place | Continue with the procedure that sent you here |
    | 42 | The user has to act | Step 3 |
-   | 1 | Called wrongly, or `tools/prerequisites.txt` is missing next to the script | Report the exact command and output to the user; do not retry blindly |
+   | 1 | Called wrongly, a download or unpack failed (asset mode), or the stack tree next to the script is incomplete | Report the exact command and output to the user; do not retry blindly |
 
 3. **On exit 42, show the output to the user exactly as it is, then stop and wait.** It is
    written for someone without an IT background: each numbered block says what is missing, why
@@ -99,10 +99,30 @@ It is safe to run at any time: a second run on a ready checkout changes nothing
 
 ## Decision points
 
+- **The script is a release asset, not a tree script** - there is no `tools/prerequisites.txt`
+  beside it, because the user downloaded `preflight.sh` or `preflight.ps1` from a release page
+  into an empty folder. That is the *first* install, and the script does one more thing before
+  the steps above: it downloads the release tarball and its `.sha256`, refuses unless the
+  checksum matches, and unpacks into a `chemenu/` folder next to itself; then it runs the
+  preflight of the unpacked tree, passing `--set` and its exit code through. Run it exactly as
+  in step 1 (the path is the downloaded file, not `tools/...`), and read the exit code the same
+  way. After it, every later run - including the retry after an exit 42 - is the tree's own
+  `tools/preflight.sh` or `tools/preflight.ps1`, run from inside `chemenu/`.
+  - `--into <path>` unpacks somewhere else; an existing target is refused with exit 1 and
+    nothing is touched, which is the user's decision to make, not yours to resolve by deleting.
+  - `--archive <tarball>` uses a tarball already on disk, with its `<tarball>.sha256` beside it,
+    when the machine cannot download.
+  - A checksum that does not match, a failed download, and a copy of the script that carries no
+    download address (it was not taken from a release) exit 1 with nothing unpacked; report the
+    message, and do not fetch the tarball by another route.
+  - On POSIX, `curl`, `tar` and `sha256sum` (or `shasum`) have to exist; when one does not, the
+    script stops with exit 42 like any other missing tool. The PowerShell script needs nothing
+    beyond what Windows ships.
 - **The output names a folder that is too long.** Only on Windows with long paths off: the
   install folder may be at most 95 characters, because every file of the wiki below it has to
   stay within 259. Moving the wiki to a shorter folder is the user's step; do not try to shorten
-  paths inside the wiki instead.
+  paths inside the wiki instead. In asset mode the length is judged at the folder the stack
+  *would* be unpacked into, before anything is unpacked; the fix is a shorter `--into`.
 - **The output names the PowerShell execution policy** (`Restricted` or `AllSigned`). The fix is a
   line the user runs in a PowerShell 7 window; it changes a setting of their account, so it is
   theirs to run. When a *group policy* sets it, nothing on this computer can override it: the