Authenticate first-install bootstrap before execution #325

Fresh-install instructions still clone the mutable GitHub default branch and execute Bails/b before authenticating an immutable release. A repository-account or delivery compromise therefore becomes code execution in the unlocked Tails session.

Expected fix: publish authenticated release media and verify the selected immutable signed release against an independently established release-key fingerprint before executing it. Do not use a mutable clone as trusted installation media.

Split from #206; #223 fixes authenticated updates after installation.