security: pin base-demo bootstrap inputs

[codeforester]

Fixes #252

Summary

• Pin release-mode Base installer content, Base commit, and base-demo release commit.
• Add explicit --dev and BASE_DEMO_DEV_MODE paths that preserve sibling contributor checkouts without pulls or branch changes.
• Fail closed on missing/mismatched checksums and divergent or dirty existing release checkouts.
• Document the release/developer contract and enforce bootstrap pins through release identity checks.

Validation

• bash -n install.sh
• shellcheck install.sh tests/install_test.bats
• bats tests/install_test.bats
• ./bin/base-demo-release-check
• mise run validate
• git diff --check

Notes

The release defaults are Base v1.8.0 at 26b9af5dee16efcb47e652513ce734b3ae9bc920 and base-demo v0.1.0 at b74521c85d410cb67e497560976e0d95fc53fd41. Future release PRs must update the project pin and, when needed, the coordinated Base installer ref, commit, and checksum.