archive: restore trees with read-only directories; bump to 0.2.2

DecodeDir applied each archived mode as its entry landed, so a 0555
directory became read-only the moment it was created and the first file
written into it failed with EACCES. That is not an edge case: the Go
module cache is 0555 directories and 0444 files throughout, and it is the
main thing dir download is pointed at. Build #295 died on the first cache
HIT of the new gomod key, having passed on the miss.

Directories are now created with the owner-write bit forced on and their
recorded mode applied after extraction finishes, deepest-first. Files are
written writable and chmod'ed after the copy, and a read-only file left
by an earlier restore is replaced rather than treated as an error —
re-restoring over a populated module cache is normal in CI.

Both tests fail against the previous DecodeDir with the same 'permission
denied' the build reported.

install.sh: verify checksums without coreutils extensions; bump to 0.2.1

sha256sum -c --ignore-missing is a coreutils extension. Alpine ships
busybox sha256sum, which prints its usage and exits non-zero, so the
bootstrap died with a 'checksum mismatch' that was nothing of the sort —
on the exact distro the sr-ht-cover manifest builds on. Pull the expected
hash out of checksums.txt with awk and compare strings instead; busybox,
coreutils and macOS shasum all agree on 'sha256sum FILE'.

Also stage the binary inside the target directory and rename it into
place, so an install over a running cacher can't hit ETXTBSY.

Verified against the published release on alpine:edge (busybox) and
ubuntu:noble (coreutils), and across all four published assets by faking
uname: Linux/x86_64, Linux/aarch64, Darwin/x86_64, Darwin/arm64 each
fetch the matching binary and verify.

Bump VERSION to 0.2.0 for tag

README, landing page, CHANGELOG: document --exec, --optional, install.sh

Rewrites the directory-caching and docker sections around --exec instead
of the shell branch, replaces the bootstrap task in the full builds.sr.ht
example with the install.sh one-liner, and records that the --exec
script's exit status is propagated verbatim in the exit-code table.

Bump VERSION to 0.1.2; widen landing page to 55rem

Bump VERSION to 0.1.1 for tag

Add goreleaser + CHANGELOG.md; cross-platform downloads on site

* .goreleaser.yml — builds linux/{amd64,arm64} and darwin/{amd64,arm64}
  as raw binaries (formats: binary) with CGO_ENABLED=0, trimpath, version
  ldflag injection. GitHub release disabled; we publish via pages.sr.ht.

* CHANGELOG.md — Keep-a-Changelog format. v0.1.0 entry summarizes the
  full surface (init/doctor, single-file/docker/dir caching, --hash-from,
  Garage compat, e2e suite, CI manifests).

* .builds/publish.yml — installs goreleaser binary release (pinned to
  v2.7.0), runs `goreleaser release --clean --skip=publish`, flattens
  the 4 dist/cacher_<os>_<arch>_v<n>/cacher paths into
  pages/cacher-<os>-<arch>, regenerates checksums.txt to match the
  published filenames, renders CHANGELOG.md to HTML via cmark with
  heading demotion (h1→drop, h2→h3, h3→h4), substitutes per-platform
  sha256s into docs/index.html, and ships everything to
  bigbes.pages.srht.bigb.es/ci-cacher/ plus the build artifacts list.

* docs/index.html — Download section is now a 4-row table with per-
  platform sha256s, plus a Changelog section that embeds the rendered
  CHANGELOG.md inline.