test(install): cover attestation gate, keep checksum tests host-independent

The release attestation gate added this cycle (PR #984) had zero coverage,
so add tests for verify_release_attestation's 2/0/1 return codes (via a PATH
gh stub, since the exec'd binary bypasses function mocks) and for the policy
gate in verify_release_asset_checksum.

The same gate also broke the two happy-path checksum tests on any host with
an authenticated gh: they run `gh attestation verify` against synthetic
fixtures and fail. Stub verify_release_attestation to the gh-unavailable
return so those tests exercise the checksum-only path regardless of host gh
state. CI without gh masked this.