install.sh: Alacritty from its release DMG, under a stated rule

Homebrew disabled the alacritty cask on 2026-09-01: upstream builds are ad-hoc
signed and not notarized. Existing installs kept it, but a new Mac got no
Alacritty, and this repo's config, Dock, Hammerspoon and terminal-set-opacity
all assume one.

Clearing a quarantine flag is now allowed under one rule instead of never: the
file is pinned by a hash reviewed here, its signature verifies as unmodified,
and the app is named explicitly. Alacritty passes -- the v0.17.0 DMG matches
GitHub's published digest, and codesign --verify --deep --strict passes.
toggleMute failed on the signature, which is why it stays dropped. The hash is
hard-coded rather than looked up, since a checksum fetched beside the file
catches corruption, not substitution.

The filed version wrapped the steps in `( set -euo pipefail ... ) || warn`,
and bash ignores set -e on the left of ||: a wrong hash still installed the
app. Each step now exits by hand. Tested against a scratch target with the
right hash, a wrong hash, and a failing signature check.

From change request 56fc45.

0 files changed, 0 insertions, 0 deletions