Fix self-review findings and streamline installer updates

[ojowwalker77]

Summary

• verify gitleaks and osv-scanner downloads against upstream SHA-256 manifests and fail closed on verification errors
• compare OSV results with the base lockfile so only newly introduced advisory/package/version tuples are reported
• recompute triage summary counts from the final kept findings
• replace noisy reinstall-style updates with a compact splus update flow that preserves agent wiring and omits onboarding
• add installer smoke coverage to CI and document the new update behavior

Verification

• cargo test --workspace --locked
• pnpm -r build
• pnpm -r typecheck
• pnpm -r test
• pnpm build:release
• node --check dist-release/mcp.cjs
• sh -n install.sh scripts/test-install.sh
• sh scripts/test-install.sh
• Splus precise working-tree review: 0 must-fix, 0 concern, 0 nit

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}