bin/: add zarf

zarf v0.81.0 (current latest), a single static binary for offline/airgapped
Kubernetes. Both Linux release assets verified to resolve; install is
idempotent via the ~/.local/bin/.versions stamp.

Also drops a stray leading space from install_opencode's argument line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -40,8 +40,9 @@ Already have a clone? Just run it directly:
 - `bin/` — installs userland devops CLIs as self-contained, statically
   linked release binaries into `~/.local/bin`: jq, kubectl, helm, k9s,
   kubectx/kubens, stern, yq, OpenTofu, terragrunt, task (go-task, the
-  Taskfile runner), the 1Password CLI `op` for secrets storage, and the
-  opencode coding agent. kind is installed
+  Taskfile runner), the 1Password CLI `op` for secrets storage, the
+  opencode coding agent, and zarf (DevSecOps for Offline and Airgapped
+  Kubernetes). kind is installed
   only when full (non-rootless) Docker is available — it doesn't work
   against rootless Docker, so it is skipped on Kasm. No sudo, nothing
   outside `$HOME`, so tools persist across Kasm redeploys with no