setup.sh: cargo-binstall bootstrap is an unpinned curl|bash — digest-pin it like component.sh #29

`scripts/setup.sh:47-50` pipes `install-from-binstall-release.sh` from cargo-binstall's `main` branch straight into bash: a floating, unpinned script that then installs the latest release. Every other tool in the script is version-pinned, and the repository's own `js/componentize/wpt/component.sh` sets the precedent this should follow — download a pinned artifact, verify a committed sha256, fail closed.

From the 2026-08 timing-surface survey (supply-chain side note). Fix: pin the cargo-binstall version, fetch the release asset for the host triple directly (skipping the bootstrap script entirely), verify against committed digests, and fall back to `cargo install --locked --version` (registry checksums) on unlisted platforms.

The same pattern exists in sibling setup scripts (polymorph-iroh, polymorph-webcrypto); this issue covers this repository, and the fixed block is designed to be copyable.