Add bin/ module: userland CLI tools into ~/.local/bin

New bin/install.sh downloads self-contained release binaries (ripgrep, fd,
bat, fzf, jq) into ~/.local/bin — no sudo, nothing outside $HOME, so they
persist across Kasm redeploys with no reinstall. Statically linked where
available, so they keep working even after the root fs is wiped. Idempotent:
pinned versions already present are skipped.

lib/fetch.sh adds arch detection + tarball/raw binary download helpers.
zsh/zshrc puts ~/.local/bin on PATH; bootstrap.sh runs the module.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -30,8 +30,14 @@ Already have a clone? Just run it directly:
 - `git/` — sets git `user.name`/`user.email` and configures
   `credential.helper store` (plaintext `~/.git-credentials`, 0600) for
   HTTPS auth.
+- `bin/` — installs userland CLI tools (ripgrep, fd, bat, fzf, jq) as
+  self-contained release binaries into `~/.local/bin`. No sudo, nothing
+  outside `$HOME`, so they persist across Kasm redeploys with no reinstall.
+  Idempotent: pinned versions already present are skipped. `zsh/zshrc` puts
+  `~/.local/bin` on `PATH`.
 - `mcp-config/` — shared MCP gateway config sync for laptops (LiteLLM /
   opencode). Independent of `bootstrap.sh`; see its own README.
 
 `lib/os-detect.sh` provides shared package-manager detection (`dnf`/`yum`
-vs `apt`) used by module install scripts.
+vs `apt`); `lib/fetch.sh` provides arch detection and binary-download
+helpers. Both are used by module install scripts.