install.sh: verify release attestation via gh CLI (#984)

Anchors the downloaded SHA256SUMS file to its GitHub Actions
build-provenance attestation (already produced by release.yml via
actions/attest-build-provenance) before reading checksums from it.
This closes a gap where the SHA256SUMS file is trusted purely on the
basis of its GitHub release URL — a release-page-write compromise
could otherwise swap both the binary and its sums entry together.

Behavior:
- If gh CLI is available and authenticated, the attestation is
  verified with --owner tw93 --deny-self-hosted-runners. A mismatch
  is fatal and the install aborts.
- If gh is unavailable or unauthenticated, the installer falls back
  to the existing sha256-only verification (no behavior change for
  current users).
- MOLE_REQUIRE_ATTESTATION=1 turns the soft check into a hard
  requirement: missing gh becomes an install failure.

Verifying SHA256SUMS is sufficient because the binary's sha256 is
then anchored to that attested file by verify_release_asset_checksum
in the line below.