Separate tool facts from install mechanics

The shared helper enables fail-fast shell behavior and requires TOOLCHAIN_INSTALL_PREFIX as it is sourced. The ${NAME:?message} expansion stops before any directory is created when the caller has not selected a destination.

Making the boundary explicit lets Make provide the repository-local prefix later, while tests and direct runs can safely choose a temporary tree.

The first fetch creates a temporary directory inside the install prefix and registers cleanup traps. The stable bin directory is not the download destination.

After curl succeeds, the helper computes the staged file's SHA-256 value with sha256sum -c. A mismatch aborts before extraction or publication can trust the bytes.

Only after fetch, verification, and extraction does install_bin validate the staged executable and create the destination directory.

The staging directorystaging directory lives on the same filesystem as bin, so the final mv can publish the completed executable by rename instead of writing the stable path incrementally.