Make getting-started installs fail closed and plans current

Chain signed installer downloads, verification and execution in the English, German and Spanish landing pages so a failed trust step cannot run stale or unverified bytes. Keep the pinned signer, namespace and release URLs, preserve real installer exits, and correct the existing plan and paired-app retirement guidance. Exercise the copyable Bash gate with offline command stubs and run those documentation regressions in Public docs CI.

Contract-Neutral: Public documentation and its secret-free CI validation only; no runtime, entitlement, release-selection or subsystem contract delta.
Change-source: pulse-maintainer

.github/workflows/public-docs.yml

@@ -9,6 +9,7 @@ on:
       - ".github/ISSUE_TEMPLATE/**"
       - "scripts/check_public_docs.py"
       - "scripts/check_docs_mirror.py"
+      - "scripts/readme_entrypoints_test.py"
       - ".github/workflows/public-docs.yml"
   push:
     branches:
@@ -20,6 +21,7 @@ on:
       - ".github/ISSUE_TEMPLATE/**"
       - "scripts/check_public_docs.py"
       - "scripts/check_docs_mirror.py"
+      - "scripts/readme_entrypoints_test.py"
       - ".github/workflows/public-docs.yml"
 
 permissions:
@@ -42,5 +44,8 @@ jobs:
       - name: Validate public documentation
         run: python3 scripts/check_public_docs.py
 
+      - name: Check getting-started safety and current plans
+        run: python3 scripts/readme_entrypoints_test.py
+
       - name: Check shipped docs mirror sync
         run: python3 scripts/check_docs_mirror.py