[margani]

Closes #98.

What changed

• ops-get writes the verified script to a new mktemp file in the destination's directory, sets mode 755, and renames it over the destination. If any step fails (for example, renaming over another user's file in a sticky directory), it removes the temp file and stops with a message. A destination that is a directory is refused.
• ops-get.ps1 does the same with a GUID-named temp file and Move-Item -Force.
• README and server/README quick starts fetch to ./server.sh instead of /tmp/server.sh.

Why

cp onto an existing destination rewrote that file in place. The file kept its owner, and a 0666 file became 0777 after chmod +x, so the file later run with sudo was not bound to the verified bytes.

Verification

• tests/ops-get_test.sh: new case pre-creates a 0666 destination and asserts a new inode, mode 755, the right content and no leftover temp file. On the old code: FAIL: the existing destination was written in place.
• tests/ops-get_test.ps1 (pwsh 7 on Linux): a hard link to the pre-existing file must keep the old content. On the old code: FAIL: the existing destination was written in place; new code: PASS.
• ./run-tests: all 10 passed, 3 skipped.
• ops-get.ps1 stays ASCII-only (checked).

Not verified

• Windows PowerShell 5.1 and Windows pwsh run in CI on this PR.
• A real two-user host. The sticky-directory refusal follows from rename(2) semantics and was not run with two uids.
• ops-get's hash changes. README's pinned hash is updated after the next release, as usual.