Harden Atomic Topgrade installs

[hermes-archham]

Summary

• change Atomic Fedora / rpm-ostree / bootc installs to use the official upstream GitHub release binary in ~/.local/bin/topgrade instead of enabling COPR or layering a Topgrade RPM
• harden GitHub release installs with explicit release metadata lookup, exact Linux asset selection, SHA-256 digest verification when GitHub exposes it, archive path checks, version smoke testing, and atomic activation
• add --version vX.Y.Z / TOPGRADE_VERSION support for pinned installs and update existing config handling to make small policy repairs with backups
• update English and German README behavior notes

Validation

• bash -n install-topgrade.sh
• ShellCheck v0.11.0 with --severity=error install-topgrade.sh
• simulated Atomic install with stubbed rpm-ostree/rpm, temporary HOME and XDG_CONFIG_HOME, pinned to v17.9.0:
  • selected topgrade-v17.9.0-x86_64-unknown-linux-gnu.tar.gz
  • verified GitHub release asset SHA-256 digest
  • installed ~/.local/bin/topgrade
  • topgrade --version returned topgrade 17.9.0
  • generated config contained rpm_ostree = true and did not set no_self_update
• simulated existing-config migration:
  • changed no_self_update = true to no_self_update = false
  • changed rpm_ostree = false to rpm_ostree = true
  • created a timestamped backup

[hermes-archham]

Updated after main was synced with upstream.

Current PR head: 1be9f089a23ad38687902b541ab904378e186bee
Base: a7359f3358ebf097a486d61016dacfe5812de892

Validation rerun after rebase:

• bash -n install-topgrade.sh
• ShellCheck v0.11.0 with --severity=error install-topgrade.sh
• simulated Atomic install pinned to v17.9.0; digest verified, binary installed, topgrade --version returned topgrade 17.9.0, generated config contained rpm_ostree = true
• simulated existing-config repair changed stale no_self_update = true to false, changed rpm_ostree = false to true, and created a timestamped backup
• git diff --check

GitHub currently reports no checks for this fork/branch.

[hermes-archham]

Debug refresh force-push completed.

Current PR head: 0d4664f8c07f52949bcd7899b3fa28178214ad9a

Temporary no-op markers were added to the three files already changed by this PR (README.md, README.de.md, install-topgrade.sh) to force GitHub to refresh the diff/check state. These markers are intentionally harmless and can be removed later.

Validation after refresh:

• local bash -n install-topgrade.sh
• local git diff --check
• GitHub ShellCheck passed for both push and pull_request runs

[hermes-archham]

Updated this PR after the COPR trust-scope review.

Why this stays in PR #1: the change revises the same Atomic install redesign before merge, so updating the open PR keeps the review in one place instead of creating a competing follow-up PR.

Current PR head: 4f1528b80ba481780accb35c2c7681ca4a1116c7

What changed:

• removed the temporary debug refresh markers
• added explicit Atomic install selection: --install-method=binary|copr
• added aliases: --binary and --copr
• interactive Atomic sessions prompt when no method is provided
• non-interactive Atomic sessions default to the binary method
• restored COPR/rpm-ostree as a supported Atomic option
• hardened the COPR repo file with includepkgs=topgrade
• kept the hardened upstream binary path from the earlier PR version
• updated English and German docs to describe both trust/ownership models neutrally

Validation:

• local bash -n install-topgrade.sh
• local ShellCheck v0.11.0 with --severity=error install-topgrade.sh
• simulated Atomic binary install pinned to v17.9.0: digest verified, binary installed, topgrade --version returned topgrade 17.9.0, generated config contained rpm_ostree = true, self-update remained enabled
• simulated Atomic COPR install: repo file installed with includepkgs=topgrade, generated config contained rpm_ostree = true and no_self_update = true, reboot message shown
• simulated non-interactive Atomic run with no method: defaulted to binary
• local git diff --check
• GitHub ShellCheck passed for push and pull_request runs

[archham]

OK