feat(installer): implement Phase 1 — the installer core

Adds the Rust crate at the repo root and implements `install` end to end for
the overlay half of a deployment: resolve the published bundle, find and
validate the ServUO root, refuse to deploy under a running shard, sync the
plugin overlay, and record what was deployed in install.json.

`doctor`, `update` and `uninstall` parse and answer with the phase they arrive
in rather than "unrecognized command", and the run states plainly that the
uo-link sidecar (Phase 2) and the patch tier (Phase 3) were not installed —
`--patches` in particular reports REQUESTED BUT NOT APPLIED, since a quiet
completion would be read as a patched shard.

Landing on `edge` rather than `main`: release.yml publishes a binary on every
push to main, and an installer that deploys the overlay but cannot install the
sidecar is not something to hand an operator. pr-checks.yml now gates PRs into
edge on the same rules, so the branch the work happens on is not the ungated
one.

Notable decisions, all documented in docs/installer/PLAN.md §5 Phase 1:

- The code lives in a library called `rgdeploy` with a thin binary that keeps
  the published name. Windows' UAC installer detection refuses to launch an
  unsigned executable whose file name contains "install" (os error 740), and
  Cargo names test harnesses after their target — so a target under that name
  makes `cargo test` unrunnable on Windows.
- The running-shard check matches processes by path, not by process name:
  on Linux a live shard is `mono`/`dotnet` with ServUO.exe as an argument, and
  a name match would report "not running" for a shard that is running.
- install.json records a state (`deployed` / `kept-operator-modified`), not the
  run's verb, so an unchanged re-run produces an identical record and writes
  nothing.
- The Bridge.cfg keep rule compares against the hash the installer last
  deployed, not the last hash it saw — otherwise a kept file is overwritten on
  the very next run.
- Downloads are verified against the bundle's SHA256 while being written, then
  every extracted file is re-hashed against the release's own manifest.json,
  whose protocol and version are cross-checked against the bundle.

Verified against a real ServUO 57.4 tree and end to end into a scratch tree:
24 files deployed, an unchanged re-run that writes nothing, an edited
Bridge.cfg kept across repeated runs while code files are overwritten, bundle
pinning, and a refusal with a shard running out of the tree.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -21,10 +21,14 @@
 #   • Artifact names follow docs/installer/PLAN.md §3.
 #
 # ── Crate guard ──────────────────────────────────────────────────────────────
-# The repo is in the planning phase. With no Cargo.toml there is nothing to
-# build, so the plan step forces RELEASE=false and the job exits green having
-# done nothing. It starts cutting real releases the moment Phase 1 lands the
-# crate — no edit required here.
+# With no Cargo.toml at the repo root there is nothing to build, so the plan step
+# forces RELEASE=false and the job exits green having done nothing.
+#
+# That guard is what makes the `edge` branch work. Phase 1 (installer core) and
+# Phase 2 (sidecar + service) land on `edge`, so `main` stays crate-free and this
+# workflow keeps standing down — an installer binary that syncs the overlay but
+# cannot install the sidecar is not something to publish to operators. The first
+# release is cut by the `edge → main` cutover, with no edit required here.
 #
 # ── Unsigned releases ────────────────────────────────────────────────────────
 # Per PLAN.md §3, installer binaries are deliberately UNSIGNED: SHA256SUMS is