Install and update from signed metadata

Customers should use the bootstrap installer. It reads latest metadata, chooses the Linux x64 artifact, verifies size and SHA-256, then runs the commercial installer.