fix(install): validate redirect URL origin before trusting resolved version

[latenighthackathon]

Summary

resolve_redirect() follows HTTP redirects to determine the latest release tag but never validates the final URL origin. A compromised CDN, DNS poisoning, or open redirect could cause the installer to download binaries from an attacker-controlled server. This adds origin validation and caps redirect depth as defense-in-depth.

Related Issue

Closes#638

Changes

• Added origin validation in resolve_redirect(): resolved URLs must match https://github.com/NVIDIA/OpenShell/* or the installer aborts.
• Capped redirect depth in download() to 5 as defense-in-depth.

Testing

• mise run pre-commit passes
• Shell script changes only (no Rust changes)

Executed:

• mise run pre-commit locally: format, license, and lint checks pass
• Compile/test steps require Linux CI runners
• Verified install.sh test jobs pass in CI (bash, sh, fish, zsh all green)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[latenighthackathon]

I have read the DCO document and I hereby sign the DCO.

[drew]

Resolved in #724