feat: refcount linking, signed feed install, real-Linux pinned-load proof (alpha-2)

[ipfizz]

Builds on the engine store toward "demonstrated", not just "mechanically true".

• Auto-link on launch — when an app resolves a pinned engine it registers itself in the store's .links refcount, so GC/prune are real (no more all-unreferenced footgun in practice).
• Signed feed install — bunmaska engine install <url> fetches a .tar.zst + .json + .sig, verifies an Ed25519 detached signature (BUNMASKA_ENGINE_PUBKEY) and the content hash before extracting. Fixture-tested end to end (no CDN needed).
• Real-Linux pinned-load proof — a Linux-CI integration test relocates the system WebKitGTK into a store dir, pins an app to it, and a fresh-process probe asserts via /proc/self/maps that WebKit loaded from the store path, not the system soname. This validates resolve → store → dlopen on a real box (the Ubuntu/xvfb leg).

Bumps to 0.1.0-alpha.2.

Still follow-ups: a genuinely relocatable, cross-distro engine BUILD (this proof relocates the system lib); a hosted signed feed; macOS pinned engine (researched, spike pending an Apple cert); Windows (skipped — WinCairo when picked up, never WebView2).

🤖 Generated with Claude Code