Add checksum-verified release installers

README.md

@@ -6,6 +6,53 @@ documents, blobs, pipes, and future multi-user collaboration.
 This project is not the Ethereum `geth` client. The project and executable are
 still named `geth`.
 
+## Install A Release
+
+Choose an explicit release tag. On Linux x86_64 or macOS x86_64/arm64:
+
+```sh
+version=v0.1.0
+curl -fLO "https://forge.tionis.dev/eric/geth/releases/download/$version/install.sh"
+sh install.sh --version "$version"
+```
+
+On Windows x86_64 in PowerShell:
+
+```powershell
+$Version = 'v0.1.0'
+Invoke-WebRequest "https://forge.tionis.dev/eric/geth/releases/download/$Version/install.ps1" -OutFile install.ps1
+Unblock-File .\install.ps1
+.\install.ps1 -Version $Version
+```
+
+Replace `v0.1.0` with the release you intend to install. Both installers fetch
+the platform archive and its `.sha256` file, reject a checksum mismatch, and
+install only the single `geth` executable. They do not initialize trust state
+or start a daemon. The Unix default is `$HOME/.local/bin`; the installer prints
+the profile it updates when that directory is not already on `PATH`. Windows
+defaults to the current user's local program directory and adds that directory
+to the user `PATH`. Pass `--no-modify-path` or `-NoModifyPath` to opt out and
+receive manual setup guidance. A mirror can be selected with
+`GETH_RELEASE_BASE_URL`, and downloaded archives can be verified and installed
+offline with `--archive` or `-ArchivePath`.
+
+For an upgrade, create a backup, stop the daemon, rerun the installer with the
+new explicit tag, then start and check it:
+
+```sh
+geth backup create --out ./geth-backup
+geth daemon stop
+sh install.sh --version v0.2.0
+geth daemon start
+geth wait daemon
+geth status
+```
+
+Uninstall the user service first with `geth daemon uninstall`, then remove the
+installed `geth`/`geth.exe` file. This intentionally preserves the selected
+geth home. Back it up and remove it separately only when you explicitly want to
+delete identity, trust, metadata, and CAS state.
+
 ## First 10 Minutes
 
 Build the single binary and start a disposable daemon:
@@ -779,9 +826,10 @@ GitHub Actions workflows live under `.github/workflows/`:
 - `codeql.yml` builds the Rust workspace for GitHub CodeQL analysis.
 - `dependency-review.yml` blocks pull requests that introduce vulnerable
   dependency changes at moderate severity or higher.
-- `release.yml` builds release archives for Linux, macOS, and Windows, includes
-  README/docs/license files, smoke-tests the packaged binary from the archive,
-  uploads artifacts, and publishes them on `v*` tags or manual dispatch.
+- `release.yml` builds release archives for Linux, Intel/Apple Silicon macOS,
+  and Windows, includes README/docs/license files, creates individual and
+  aggregate SHA-256 checksums, smoke-tests the packaged binary through the
+  release installers, and publishes them on `v*` tags or manual dispatch.
 - `docs/release-support-policy.md` defines supported platforms, compatibility
   expectations, security update handling, and the user-level service boundary.
 - `.github/dependabot.yml` opens weekly Cargo and GitHub Actions update PRs.