Add bin/ module: userland CLI tools into ~/.local/bin

New bin/install.sh downloads self-contained release binaries (ripgrep, fd,
bat, fzf, jq) into ~/.local/bin — no sudo, nothing outside $HOME, so they
persist across Kasm redeploys with no reinstall. Statically linked where
available, so they keep working even after the root fs is wiped. Idempotent:
pinned versions already present are skipped.

lib/fetch.sh adds arch detection + tarball/raw binary download helpers.
zsh/zshrc puts ~/.local/bin on PATH; bootstrap.sh runs the module.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/fetch.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env sh
+# lib/fetch.sh — helpers for installing userland binaries into ~/.local/bin.
+#
+# Everything lands under $HOME, so installed tools survive Kasm redeploys
+# (which wipe the root filesystem but keep $HOME) with no reinstall needed.
+# No sudo, no system packages. Prefer statically linked (musl) release
+# binaries so they keep working even after the root fs — and its shared
+# libraries — is reset.
+#
+# Source this (callers already run `set -eu`), then use fetch_arch,
+# have_version, install_tarball_bin, and install_raw_bin.
+
+BIN_DIR="${BIN_DIR:-$HOME/.local/bin}"
+
+fsay() { printf '%s\n' "$*" >&2; }
+
+# Normalize `uname -m` to the canonical arch tokens used below.
+fetch_arch() {
+  case "$(uname -m)" in
+    x86_64|amd64) printf 'x86_64\n' ;;
+    aarch64|arm64) printf 'aarch64\n' ;;
+    *) fsay "fetch: unsupported arch $(uname -m)"; return 1 ;;
+  esac
+}
+
+# Download <url> to <dest-file> using whatever downloader is available.
+_fetch_dl() {
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$1" -o "$2"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -qO "$2" "$1"
+  else
+    fsay "fetch: need curl or wget"; return 1
+  fi
+}
+
+# have_version <cmd> <version-substring> — true if ~/.local/bin/<cmd> exists
+# and reports the given version, so bootstrap can skip a re-download.
+have_version() {
+  _bin="$BIN_DIR/$1"
+  [ -x "$_bin" ] || return 1
+  "$_bin" --version 2>/dev/null | grep -qF "$2"
+}
+
+# install_tarball_bin <url> <path-within-archive> <dest-name> — download a
+# .tar.gz, extract, and install one binary from it into ~/.local/bin.
+install_tarball_bin() {
+  mkdir -p "$BIN_DIR"
+  _tmp="$(mktemp -d)"
+  _fetch_dl "$1" "$_tmp/archive.tar.gz"
+  tar -xzf "$_tmp/archive.tar.gz" -C "$_tmp"
+  install -m 0755 "$_tmp/$2" "$BIN_DIR/$3"
+  rm -rf "$_tmp"
+  fsay "installed $BIN_DIR/$3"
+}
+
+# install_raw_bin <url> <dest-name> — download a single raw binary.
+install_raw_bin() {
+  mkdir -p "$BIN_DIR"
+  _tmp="$(mktemp)"
+  _fetch_dl "$1" "$_tmp"
+  install -m 0755 "$_tmp" "$BIN_DIR/$2"
+  rm -f "$_tmp"
+  fsay "installed $BIN_DIR/$2"
+}