fix(security): declare the printed install-script URL on the allow-list

[DeusData]

Release run 30435312575 was blocked by security-static:

BLOCKED: src/cli/cli.c: URL not on allow-list: https://raw.githubusercontent.com/DeusData/

Two problems, both fixed:

1. Undeclared. The update handoff prints a curl one-liner when install.sh isn't beside the binary. It's the same URL as our documented one-liner install, and it's printed for the user to paste — the binary no longer downloads anything.
2. Unmatchable. The URL was split across string-literal continuations, so the audit extracted only https://raw.githubusercontent.com/DeusData/. An allow-list entry for the real URL could never have matched. Hoisted to a single CBM_INSTALL_SH_URL token so the declaration means what it says.

Note the counter-intuitive detail in that job: it also reports mcp.c has 16 file read operations (expected max 15). That is pre-existing — the same tree at 560ad40 reports 17 and passed CI, because that check is advisory. This change reduced it by removing the update-check fread.

Verification

Check	Result
scripts/security-audit.sh	OK: All URLs are on the allow-list.
cli + mcp suites	436 passed, 2 skipped
Contracts (smoke fixture, windows bundle, venue parity, security strings)	pass
lint-ci	clean
Release binary contains releases/latest/download	0

Follow-up queued: have install.sh copy itself next to the binary so update always references a local file and the URL can be dropped entirely.