Install ergonomics: GitHub release workflow + install.sh + README quickstart

For 'people should say just use iamroot' framing, the install gate is
the single biggest discoverability bottleneck. This commit makes it:

  curl -sSL https://github.com/KaraZajac/IAMROOT/releases/latest/download/install.sh | sh

.github/workflows/release.yml:
- Triggers on semver tag push (v*.*.*) + manual dispatch.
- Matrix build for x86_64 (gcc) and arm64 (aarch64-linux-gnu-gcc cross).
- Per-arch sha256sum alongside the binary.
- Auto-generates release notes pointing at CVES.md / ROADMAP.md and
  including the install one-liner with the version-specific URL.
- Publishes via softprops/action-gh-release@v2.

install.sh (also uploaded as a release artifact, so the curl|sh
above is stable):
- Detects arch (x86_64 / aarch64 → arm64).
- Pulls iamroot-<arch> + iamroot-<arch>.sha256 from the requested
  version (default: latest).
- Verifies sha256 via sha256sum or shasum -a 256.
- Installs to /usr/local/bin/iamroot (or $IAMROOT_PREFIX). Uses sudo
  iff /usr/local/bin isn't already writable.
- Prints quickstart hints + ethics pointer at the end.
- Env knobs: IAMROOT_VERSION, IAMROOT_PREFIX, IAMROOT_REPO.

README.md gains a 'Quickstart' section at the top with the four
canonical commands: install, --scan, --audit, --detect-rules,
fleet-scan. Lands the 'curl|bash and go' UX as the first thing
visitors see.

README.md

@@ -19,6 +19,29 @@
 > tool. By using it you assert you have explicit authorization to test
 > the target system. See [`docs/ETHICS.md`](docs/ETHICS.md).
 
+## Quickstart
+
+```bash
+# One-shot install (x86_64 / arm64; checksum-verified)
+curl -sSL https://github.com/KaraZajac/IAMROOT/releases/latest/download/install.sh | sh
+
+# What's this box vulnerable to?
+sudo iamroot --scan
+
+# Broader system hygiene (setuid binaries, world-writable, capabilities, sudo)
+sudo iamroot --audit
+
+# Deploy detection rules across every bundled module
+sudo iamroot --detect-rules --format=auditd | sudo tee /etc/audit/rules.d/99-iamroot.rules
+
+# Fleet scan (any-sized host list via SSH; aggregated JSON for SIEM)
+./tools/iamroot-fleet-scan.sh --binary iamroot --ssh-key ~/.ssh/id_rsa hosts.txt
+```
+
+`iamroot --help` lists every command. See [`CVES.md`](CVES.md) for the
+curated CVE inventory and [`docs/DEFENDERS.md`](docs/DEFENDERS.md) for
+the blue-team deployment guide.
+
 ## What this is
 
 Most Linux LPE references are dead repos, broken PoCs, or single-CVE