feat(install): install without reaching github.com (SOCKET_PATCH_BASE_URL)

[Mikola Lysenko (mikolalysenko)]

Stacked on #145 (base: feat/hosted-installer) — review that one first.
Companion: SocketDev/depscan#23909, which serves the relay this talks to.

What

Lets install.sh install without reaching github.com, via a new
SOCKET_PATCH_BASE_URL pointing at any releases base that answers GitHub's two asset
paths:

curl -fsSL https://install.socket.dev/patch \
| SOCKET_PATCH_BASE_URL=https://install.socket.dev/SocketDev/socket-patch/releases sh

install.socket.dev relays exactly those paths from the GitHub release, which is why one
template covers both origins and the script needs no branching. Whichever origin is used,
the archive is still verified against the SHA256SUMS fetched from that same origin — the
change moves who serves the bytes, not how they are checked.

Also adds SOCKET_PATCH_INSTALL_DIR, which wins over both existing defaults. Unprivileged
installs into a toolchain-managed prefix need it, and it is what makes the script testable
without writing to a system path — both new CI steps use it.

On "a release should automatically update the hosted binary"

It already does, and this keeps it that way: nothing runs at release time. The origin
resolves "latest" per request against the upstream release, so cutting 3.4.0 makes it
installable from install.socket.dev immediately — no publish, no submodule bump, no
deploy. That property is the reason the depscan side is a relay rather than a copy.

The default is still GitHub, on purpose

Flipping it is one line, held until the relay is verified in prod. A script that defaults
to a host which does not answer yet is a broken installer for everyone running it from a
git checkout or the raw GitHub URL — and CI's end-to-end install step would fail on main
immediately. Sequence: this merges → depscan#23909 deploys → flip the default.

CI

Two steps, matching the posture of the installer-drift workflow from #145:

1. Non-default origin — installs with SOCKET_PATCH_BASE_URL set to GitHub's own
   releases base (the same URL shape the relay serves), so the template the script builds
   is covered unconditionally, today.
2. Socket origin — installs through install.socket.dev and asserts the installed
   version matches what that host reports as latest. Skips itself with a notice until the
   host resolves, so it is inert until the relay ships rather than red from merge.

Verified locally

Against the real relay logic from depscan#23909 running on this machine:

• install.sh through the relay installed 3.3.0 (latest) and 3.2.0 (pinned), both
  checksum-verified by the script itself;
• the GitHub default still installs;
• shellcheck --shell=sh and sh -n clean; the workflow YAML parses;
• and the CLI's own updater works through the same host with no CLI changes, using the
  SOCKET_UPDATE_BASE_URL override it already has:

$ SOCKET_UPDATE_BASE_URL=<relay> socket-patch --update --dry-run
socket-patch 3.3.0 is already the latest version.
$ SOCKET_UPDATE_BASE_URL=<relay> socket-patch --update 3.2.0
Updated socket-patch 3.3.0 → 3.2.0

One caveat documented in docs/installer-hosting.md rather than papered over: a
non-default SOCKET_UPDATE_BASE_URL intentionally downgrades the downloaded binary's
version self-check from hard-fail to a warning, because that knob is meant for mirrors
that may repackage. Making Socket's host a first-class endpoint set that keeps the strict
check is a CLI change, not a hosting one — deliberately not in this PR.

Not in scope

• Flipping the default origin (one-line follow-up, after prod verification).
• patch.ps1 for native Windows.

---

Note

Medium Risk
Changes the shell installer’s download and install paths—security-sensitive because users pipe the script—but behavior is opt-in via env vars, checksum verification is unchanged, and the default origin stays GitHub.

Overview
install.sh now supports installing release archives from a configurable releases base via SOCKET_PATCH_BASE_URL (GitHub-style /latest/download and /download/v<ver>/ paths), with SHA256SUMS still fetched from that same origin. SOCKET_PATCH_INSTALL_DIR overrides /usr/local/bin vs ~/.local/bin. The default download base remains GitHub.

CI adds an end-to-end install using GitHub’s releases URL as a non-default base (plus a custom install dir), and a second step that installs through install.socket.dev when /patch/latest responds, asserting the installed version matches the host’s reported latest.

Docs (README, docs/installer-hosting.md, CHANGELOG) describe the github-free one-liner, relay endpoints, and that flipping the default origin to Socket is intentionally deferred until prod verification.

^{Reviewed by Cursor Bugbot for commit d68a062. Configure here.}