Add prebuilt installers and cargo-binstall metadata

[kdy1]

Summary

• add verified prebuilt installers for cargo-mono and with-watch on Bash and PowerShell
• add first-party-only cargo-binstall metadata for cargo-mono, with-watch, and nodeup
• update internal contracts, crate READMEs, and public docs for direct install and CI usage

Testing

• cargo test
• pnpm --filter public-docs test
• git diff --check
• smoke-tested scripts/install/cargo-mono.sh --help
• smoke-tested scripts/install/with-watch.sh --help

Notes

• pwsh, cosign, and cargo-binstall were not available in the local environment, so their smoke tests were not run here.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ebf79f85c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid unbound tmp_dir in cargo-mono EXIT trap

tmp_dir is declared as a function-local variable, but the trap is registered for EXIT, which runs after install_direct returns. With set -u, that makes "$tmp_dir" unbound at process exit, so a successful install path still terminates with a non-zero status (tmp_dir: unbound variable). This will break automation that treats installer exit codes as authoritative.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Avoid unbound tmp_dir in with-watch EXIT trap

This has the same failure mode as the cargo-mono installer: tmp_dir is local to install_direct, but the EXIT trap references it after the function scope ends. Under set -u, the trap throws an unbound-variable error and the script exits non-zero even when installation succeeded, which can fail CI/bootstrap flows.

Useful? React with 👍 / 👎.