Self-hosted releases and verified updates

Zerocode upgrades pull directly from the host now, verify their checksum before installing, and replace the running binary on Windows without permission errors.

The updater downloads releases from the host rather than a third-party registry. Every download is checked against a cryptographic checksum list before the binary is written.

On Windows, replacing an active executable used to fail with permission denied. The install script stops old processes cleanly and atomically swaps the binary.

Dual command names

The command is installed as both zerocode and zerolog, so older scripts and new documentation resolve to the same binary.