Publish v2.0.3 installation instructions

[Pavel-Tk]

Summary

• make v2.0.3 the only agent-install target
• pin immutable release URLs to e4ad07cfc858618edfd69e1f3be5e8345b253037 / tag v2.0.3
• pin installer SHA-256 72247d3537140098365350020cce29658c0743fee1aa738d7143db82316acce4
• pin ZIP SHA-256 dfaa786f68dd819e1313191bb26253caf6bc52fe4b0ab4f6f8c2e2ebcb62e1a3
• refresh exact-byte policy and packaging assertions

Validation

• independently downloaded all three GitHub release assets
• recomputed both SHA-256 digests and matched published SHA256SUMS
• Ruff and 35 packaging tests passed
• pristine full-remote publication scan: no findings

[Pavel-Tk]

Adversarial critical-only pinned-release review: no critical findings. Independently recomputed installer and ZIP digests match the immutable release SHA256SUMS; URLs, tag/source identity, and packaging assertions are consistent.