install.sh: verify checksums without coreutils extensions; bump to 0.2.1

sha256sum -c --ignore-missing is a coreutils extension. Alpine ships
busybox sha256sum, which prints its usage and exits non-zero, so the
bootstrap died with a 'checksum mismatch' that was nothing of the sort —
on the exact distro the sr-ht-cover manifest builds on. Pull the expected
hash out of checksums.txt with awk and compare strings instead; busybox,
coreutils and macOS shasum all agree on 'sha256sum FILE'.

Also stage the binary inside the target directory and rename it into
place, so an install over a running cacher can't hit ETXTBSY.

Verified against the published release on alpine:edge (busybox) and
ubuntu:noble (coreutils), and across all four published assets by faking
uname: Linux/x86_64, Linux/aarch64, Darwin/x86_64, Darwin/arm64 each
fetch the matching binary and verify.

Add install.sh one-line bootstrap, published next to the binaries

Every manifest repeated the same four lines to get the binary: mkdir,
curl, chmod, and a PATH export into ~/.buildenv. install.sh does all of
it, picks the asset for the host platform, and verifies it against the
published checksums.txt — which the hand-rolled version never did.

On builds.sr.ht ~/.buildenv is sourced before each task, so the PATH
export lands from the next task onwards; keep install and `cacher init`
in separate tasks.

The checksums.txt glob stays cacher-*: install.sh must not appear in the
manifest it verifies against.