The positive installation test (run-positive-installation.sh) and
negative tests (run-negative-tests.sh) used 'gh release download',
which requires a git context and GH_TOKEN. After the Isolate Workspace
step removes .git, 'gh' fails with 'not a git repository'.
Replace all 'gh' calls with anonymous 'curl --location' to match the
real user path documented in linux-bootstrap.md: curl, sha256sum, cosign.
A real user on a clean server has none of gh, GH_TOKEN, or a repo clone.
Changes:
- run-positive-installation.sh: rewrite to use curl for all downloads,
add download() helper, add ISOLATION RULE comment, stricter shell opts
- run-negative-tests.sh: same curl migration, remove alpha.8 backward
compat test (verify-release checks for post-alpha.8 artifacts)
- release-verification.yml: remove GH_TOKEN from positive and negative
steps (only verify-assets retains it, runs before isolation)
