fix(install): add curl timeouts and size caps; changelog for #578-#589

[ajianaz]

What

• install.sh: every curl gets --connect-timeout, --max-time, --max-filesize (256 MiB archive, 1 MiB checksums/API JSON), mirroring cora upgrade.
• CHANGELOG: entries for fix(watch): detect_changes returns every source file each cycle; --filter only gates the trigger #578, fix(secrets): secrets_scanner skips test/spec/fixture/example paths entirely #579, refactor(llm): unify parse/repair/retry policy behind a Transport seam #582-fix(test): isolate tests from real data dir and bound vector index lock wait #589 and security(install): add curl timeouts and size caps to install.sh; consider signature verification #580 under [Unreleased].

Why

A stalled or hostile server could hang or flood the installer (#580). Signature verification is split out to #591.

Testing

sh -n install.sh passes; flags verified by diff. shellcheck is not installed locally; CI covers the rest.

Closes #580

🤖 Generated with Claude Code