Add prebuilt installers and cargo-binstall metadata (#379)

## Summary
- add verified prebuilt installers for `cargo-mono` and `with-watch` on
Bash and PowerShell
- add first-party-only `cargo-binstall` metadata for `cargo-mono`,
`with-watch`, and `nodeup`
- update internal contracts, crate READMEs, and public docs for direct
install and CI usage

## Testing
- `cargo test`
- `pnpm --filter public-docs test`
- `git diff --check`
- smoke-tested `scripts/install/cargo-mono.sh --help`
- smoke-tested `scripts/install/with-watch.sh --help`

## Notes
- `pwsh`, `cosign`, and `cargo-binstall` were not available in the local
environment, so their smoke tests were not run here.

Author: kdy1

apps/public-docs/cargo-mono.mdx

@@ -16,6 +16,39 @@
 - Dependency-aware publish flow with optional release tag creation: `publish`
 - Stable output contract: `--output human|json`
 
+## Install
+
+Tag contract:
+
+- `cargo-mono@v<semver>`
+
+Direct installers:
+
+```bash
+./scripts/install/cargo-mono.sh --version latest --method direct
+```
+
+```powershell
+./scripts/install/cargo-mono.ps1 -Version latest -Method direct
+```
+
+`cargo-binstall`:
+
+```bash
+cargo binstall cargo-mono --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall cargo-mono --no-confirm
+```
+
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and require `cosign`.
+
 ## Common workflows
 
 List publishable workspace crates:

apps/public-docs/nodeup.mdx

@@ -42,7 +42,22 @@ Script installer:
 ./scripts/install/nodeup.ps1 -Version latest -Method direct
 ```
 
-Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and only support bundle-enabled releases.
+`cargo-binstall`:
+
+```bash
+cargo binstall nodeup --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall nodeup --no-confirm
+```
+
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`), require `cosign`, and only support bundle-enabled releases.
 `nodeup toolchain install` supports `macOS`, `Linux`, and `Windows` x64/arm64 hosts.
 
 ## Common workflows

apps/public-docs/with-watch.mdx

@@ -21,12 +21,39 @@ Package manager:
 - macOS/Linux: `brew install delinoio/tap/with-watch`
 - Homebrew installs prebuilt archives on macOS Intel, macOS Apple Silicon, Linux amd64, and Linux arm64
 
+Direct installers:
+
+```bash
+./scripts/install/with-watch.sh --version latest --method package-manager
+```
+
+```powershell
+./scripts/install/with-watch.ps1 -Version latest -Method direct
+```
+
+`cargo-binstall`:
+
+```bash
+cargo binstall with-watch --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall with-watch --no-confirm
+```
+
 Cargo:
 
 ```bash
 cargo install with-watch
 ```
 
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and require `cosign`.
+
 ## Quick start
 
 Rerun a file reader when its input changes:

crates/AGENTS.md

@@ -30,6 +30,7 @@
 - Preserve rustup-like shim behavior: symlink strategy plus executable-name dispatch.
 - Keep channel and command identifiers stable and documented.
 - Record storage and download behavior in project docs whenever changed.
+- Keep direct installers and `cargo-binstall` metadata aligned with release asset names, signing contracts, and install docs.
 
 ### cargo-mono-Specific Rules
 
@@ -39,6 +40,7 @@
 - Keep `publish` delegation aligned with the documented contract: `cargo mono publish` must invoke `cargo publish --no-verify` in both execute and dry-run modes.
 - Ensure release automation (`bump`, `publish`) logs include structured operational context.
 - Keep runtime error output on the fixed `Summary/Context/Hint` three-line contract and include only safe debugging context values.
+- Keep direct installers and `cargo-binstall` metadata aligned with release asset names, signing contracts, and install docs.
 
 ### with-watch-Specific Rules
 
@@ -48,6 +50,7 @@
 - Keep shell support scoped to command-line expressions and do not silently broaden into shell-script control-flow without updating docs first.
 - Keep logs sufficient to explain inferred inputs, watcher anchors, snapshot counts, and rerun causes.
 - Keep public release contracts aligned across root publish-tag allowlist, `.github/workflows/release-with-watch.yml`, and Homebrew packaging assets.
+- Keep direct installers and `cargo-binstall` metadata aligned with release asset names, signing contracts, and install docs.
 
 ### serde-feather-Specific Rules
 

crates/cargo-mono/Cargo.toml

@@ -4,6 +4,40 @@ version = "0.6.6"
 edition = "2021"
 license = "MIT"
 description = "Cargo subcommand for Rust monorepo management"
+repository = "https://github.com/delinoio/oss"
+
+[package.metadata.binstall]
+disabled-strategies = ["quick-install", "compile"]
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-linux-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "cargo-mono"
+
+[package.metadata.binstall.overrides.aarch64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-linux-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "cargo-mono"
+
+[package.metadata.binstall.overrides.x86_64-apple-darwin]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-darwin-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "cargo-mono"
+
+[package.metadata.binstall.overrides.aarch64-apple-darwin]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-darwin-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "cargo-mono"
+
+[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-windows-amd64.zip"
+pkg-fmt = "zip"
+bin-dir = "cargo-mono.exe"
+
+[package.metadata.binstall.overrides.aarch64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/cargo-mono@v{ version }/cargo-mono-windows-arm64.zip"
+pkg-fmt = "zip"
+bin-dir = "cargo-mono.exe"
 
 [dependencies]
 cargo_metadata = "0.19.2"

crates/cargo-mono/README.md

@@ -2,6 +2,39 @@
 
 `cargo-mono` is the external Cargo subcommand that powers `cargo mono` for Rust monorepo workflows.
 
+## Install
+
+Tag contract:
+
+- `cargo-mono@v<semver>`
+
+Direct installers:
+
+```bash
+./scripts/install/cargo-mono.sh --version latest --method direct
+```
+
+```powershell
+./scripts/install/cargo-mono.ps1 -Version latest -Method direct
+```
+
+`cargo-binstall`:
+
+```bash
+cargo binstall cargo-mono --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall cargo-mono --no-confirm
+```
+
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and require `cosign`.
+
 ## Commands
 
 ```bash

crates/nodeup/Cargo.toml

@@ -5,6 +5,40 @@ edition = "2021"
 license = "MIT"
 description = "Rustup-like Node.js version manager"
 readme = "README.md"
+repository = "https://github.com/delinoio/oss"
+
+[package.metadata.binstall]
+disabled-strategies = ["quick-install", "compile"]
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-linux-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "nodeup"
+
+[package.metadata.binstall.overrides.aarch64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-linux-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "nodeup"
+
+[package.metadata.binstall.overrides.x86_64-apple-darwin]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-darwin-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "nodeup"
+
+[package.metadata.binstall.overrides.aarch64-apple-darwin]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-darwin-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "nodeup"
+
+[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-windows-amd64.zip"
+pkg-fmt = "zip"
+bin-dir = "nodeup-windows-amd64.exe"
+
+[package.metadata.binstall.overrides.aarch64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/nodeup@v{ version }/nodeup-windows-arm64.zip"
+pkg-fmt = "zip"
+bin-dir = "nodeup-windows-arm64.exe"
 
 [dependencies]
 clap = { version = "4.5.32", features = ["derive"] }

crates/nodeup/README.md

@@ -9,6 +9,43 @@
 - Use human-friendly output for operators and JSON output for automation.
 - Run `node`, `npm`, `npx`, `yarn`, and `pnpm` through one binary by executable-name dispatch.
 
+## Install
+
+Tag contract:
+
+- `nodeup@v<semver>`
+
+Package manager:
+
+- macOS/Linux: `brew install delinoio/tap/nodeup`
+
+Direct installers:
+
+```bash
+./scripts/install/nodeup.sh --version latest --method package-manager
+```
+
+```powershell
+./scripts/install/nodeup.ps1 -Version latest -Method direct
+```
+
+`cargo-binstall`:
+
+```bash
+cargo binstall nodeup --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall nodeup --no-confirm
+```
+
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and require `cosign`.
+
 ## Quick Command Reference
 
 - `nodeup toolchain list [--quiet|--verbose]`

crates/with-watch/Cargo.toml

@@ -7,6 +7,39 @@ description = "Watch command inputs and rerun commands when they change"
 readme = "README.md"
 repository = "https://github.com/delinoio/oss"
 
+[package.metadata.binstall]
+disabled-strategies = ["quick-install", "compile"]
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-linux-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "with-watch"
+
+[package.metadata.binstall.overrides.aarch64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-linux-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "with-watch"
+
+[package.metadata.binstall.overrides.x86_64-apple-darwin]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-darwin-amd64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "with-watch"
+
+[package.metadata.binstall.overrides.aarch64-apple-darwin]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-darwin-arm64.tar.gz"
+pkg-fmt = "tgz"
+bin-dir = "with-watch"
+
+[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-windows-amd64.zip"
+pkg-fmt = "zip"
+bin-dir = "with-watch.exe"
+
+[package.metadata.binstall.overrides.aarch64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/with-watch@v{ version }/with-watch-windows-arm64.zip"
+pkg-fmt = "zip"
+bin-dir = "with-watch.exe"
+
 [dependencies]
 blake3 = "1.8.4"
 clap = { version = "4.5.32", features = ["derive"] }

crates/with-watch/README.md

@@ -17,6 +17,29 @@ cargo install with-watch
 brew install delinoio/tap/with-watch
 ```
 
+```sh
+./scripts/install/with-watch.sh --version latest --method package-manager
+```
+
+```powershell
+./scripts/install/with-watch.ps1 -Version latest -Method direct
+```
+
+```sh
+cargo binstall with-watch --no-confirm
+```
+
+GitHub Actions:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-binstall
+- run: cargo binstall with-watch --no-confirm
+```
+
+Direct installers verify Sigstore bundle sidecars (`*.sigstore.json`) and require `cosign`.
+
 ## Command modes
 
 - Passthrough mode: `with-watch [--no-hash] [--clear] <utility> [args...]`