Verify keyring .deb signature in install.sh; remove PODUP_INSECURE_SKIP_VERIFY bypass

[Jaro-c]

Government-readiness security audit (verified vs install.sh source).

• chore: add repository baseline #1 `install.sh:168-169` — `--apt` path runs `dpkg -i` on `glyndor-archive-keyring.deb` as root with no Ed25519/SHA verification. MITM/CDN-compromise = root code exec. Add signature+checksum verification before `dpkg -i`.
• release: promote develop to main #2 `install.sh:220-228` — `PODUP_INSECURE_SKIP_VERIFY=1` is a documented crypto bypass. Remove it, or gate behind a non-default build flag with an audit log line.

Blocks government deployment.

[Jaro-c]

Landed via #323 (squash→develop).