feat: preflight as a release asset - download, verify, unpack, then run the tree preflight (#151, C)

Files changed:
- .gitea/workflows/release.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- instructions/dev/testing-conventions.md
- instructions/preflight.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/preflight.ps1
- tools/preflight.sh

tools/README.md

@@ -32,6 +32,17 @@ it with `-m pip`. It is POSIX sh because it has to run before Python is known
 to exist; exit 42 means the user has to act, and its output says how. The
 procedure an agent follows around it is `instructions/preflight.md`.
 
+Each release also attaches `preflight.sh` and `preflight.ps1` as assets, for the first install
+before any tree exists. `release.yml` writes the download address of that same release into two
+placeholder lines of the copy (`RELEASE_ARCHIVE_URL`/`RELEASE_CHECKSUM_URL` in the shell script,
+`$ReleaseArchiveUrl`/`$ReleaseChecksumUrl` in the PowerShell one; the tree copy leaves them
+empty). With no `prerequisites.txt` beside it, the script is in *asset mode*: it downloads the
+tarball and its `.sha256`, refuses on a mismatch, reads the folder limit out of the archive,
+unpacks into `<script folder>/chemenu` (`--into <path>` to choose, an existing target is refused),
+and runs the tree copy of itself, passing `--set` and its exit code through. `--archive <tarball>`
+takes a local tarball instead of a download (its `.sha256` has to lie next to it); that is also
+how the tests drive it.
+
 `tools/wikitool` refuses to start (exit 42) until the preflight has written a
 *complete* `.wikitool-tools.json` and the venv exists. Past that, every `git`
 and `rg` the package starts goes through `chemenu/toolpaths.py`, which reads
@@ -51,7 +62,7 @@ tools/
   wikitool                 entry point (POSIX sh): stops with exit 42 until the preflight has passed
   wikitool.ps1             the same entry point for PowerShell 7, which resolves `tools/wikitool` to this file first
   run_wikitool.py          what the launcher runs with the venv's Python - puts chemenu on sys.path without PYTHONPATH
-  preflight.sh             checks prerequisites.txt, records .wikitool-tools.json, creates .venv (POSIX sh)
+  preflight.sh             checks prerequisites.txt, records .wikitool-tools.json, creates .venv (POSIX sh); as the release asset, downloads and unpacks the stack first
   preflight.ps1            the same for PowerShell 7; also checks the execution policy and the Mark of the Web
   prerequisites.txt        what the machine needs, one `|`-separated line per tool - read by the preflight and `doctor`
   trace-hook               what the harness hooks call: trace_ingest.py under the venv's Python