Rebuild the one-click installer once the images and CLI are public (pre-beta)

[LKSNDRTMLKV]

Target: pre-beta, before 1.0. Blocked until the things an installer installs are published.

The old scripts/install.sh is being removed rather than repaired, because a repaired script would still have nothing to install. This issue is the installer that replaces it, written against real, pinned artefacts once they exist.

Blocked on — three distribution decisions

1. Public container images. ghcr.io/odal-node/dpp-node and …/dpp-resolver are private today: an anonymous docker manifest inspect is refused. release.yml pushes X.Y.Z, X.Y and latest.
2. A published odal binary. No GitHub Release exists for any tag, and dpp-cli is not on crates.io. The only way to get the CLI is cargo build -p dpp-cli --release from a checkout.
3. A hosted, pinned script and the files it needs. https://odal-node.io/install.sh and /docker-compose.yml both return 404. The static facade is the wrong host for anything versioned; a tag-pinned source, such as a release asset, is not.

Until then, the maintained path is docs/guides/OPERATOR-SETUP.md: clone, build odal, odal init, odal up.

Requirements — every one is a defect the old script shipped

• Never cargo install a crate name nobody owns. The old script ran cargo install odal-cli, a name that did not exist on crates.io: whoever registered it would have run code on every machine following the installer. Fetch a published binary and verify it, or reserve the name first.
• Verify what is downloaded — a checksum or signature for the binary and the compose bundle, pinned to the release. curl -sSL without --fail saved a 404 page as docker-compose.yml.
• Install the layout the compose file expects. It reads env_file: ../.env and bind-mounts ../ops/bootstrap/* relative to itself, so it must land at <root>/docker/docker-compose.yml beside <root>/ops/bootstrap/. Docker creates an empty directory for a missing mount source, and Postgres role provisioning then silently never runs. Reuse odal init's scaffold (cli/src/core/infra.rs::scaffold_install) rather than a second copy of the layout.
• Write the .env the stack requires, generated from .env.example's required set: DATABASE_POSTGRES_PASS, DATABASE_APP_PASS, KEY_STORE_PASSPHRASE, DID_WEB_BASE_URL, RESOLVER_BASE_URL, ADMIN_USERNAME, ADMIN_PASSWORD. Use NODE_PORT, the name compose maps, and no JWT variables — the engine authenticates with odal_sk_* keys and Basic local admin only.
• RESOLVER_BASE_URL must be the operator's public resolver origin, asked for, never defaulted. It is signed into every carrier and cannot be changed afterwards. See RESOLVER_BASE_URL defaults to a host that does not resolve, and the value is signed #382 / fix(node,resolver)!: require RESOLVER_BASE_URL #394.
• Never print a credential the node did not issue. The old script printed a locally generated odal_sk_… as "API Key"; it was never registered and authenticated nothing. Mint the first key with odal bootstrap.
• Pin a version. No latest for images or binaries in an installer.
• No sudo inside curl | bash without saying so up front.

Done when

On a clean machine with only Docker, the documented one-liner produces a node that boots, odal bootstrap mints a working key, a demo passport publishes, and scanning its carrier reaches the resolver. Verified by running it, not by reading it.