fix(installer): resolve asset URL by tag, robust to minified API JSON

A single-line (minified) GitHub API response broke install.sh's line-based
`grep browser_download_url | cut -d '"' -f 4`: it grabbed the 4th quote-field
of the whole blob — the release object's API `url` — so self-update downloaded
JSON and the magic-byte guard refused to install. Derive the tag (splitting on
commas so it works pretty or minified) and construct the asset URL directly.
install.ps1 uses a real JSON parser and was unaffected.

Author: Thanga-Ganapathy

CHANGELOG.md

@@ -8,6 +8,11 @@ adheres to [Semantic Versioning](https://semver.org/). Work in progress lives un
 
 ## [Unreleased]
 
+### Fixed
+- **installer** — `install.sh` derives the release tag and constructs the asset URL deterministically
+  (robust to minified API JSON), so `self-update` no longer downloads the release API object and
+  refuses to install. `install.ps1` uses a JSON parser and was unaffected.
+
 ## [0.5.0] - 2026-06-30
 
 ### Added

install.sh

@@ -38,13 +38,21 @@ if ! RELEASE_JSON="$(curl -fsSL "$API_URL")"; then
     exit 1
 fi
 
-DOWNLOAD_URL="$(printf '%s\n' "$RELEASE_JSON" | grep "browser_download_url.*$ASSET_NAME\"" | cut -d '"' -f 4)"
+# Extract the release tag, splitting on commas first so this works whether the API returns
+# pretty-printed OR minified JSON. A single-line (minified) response broke the old line-based
+# `grep | cut -f4`: it grabbed the 4th quote-field of the whole blob — the release object's API
+# `url` — and "downloaded" that JSON instead of the binary. Constructing the asset URL from the
+# tag avoids parsing the asset array entirely.
+TAG="$(printf '%s' "$RELEASE_JSON" | tr ',' '\n' | grep '"tag_name"' | head -n1 \
+    | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')"
 
-if [ -z "$DOWNLOAD_URL" ]; then
-    echo "Error: Could not find release asset for $OS_NAME $ARCH_NAME." >&2
+if [ -z "$TAG" ]; then
+    echo "Error: could not determine the latest release tag from the GitHub API." >&2
     exit 1
 fi
 
+DOWNLOAD_URL="https://github.com/$REPO/releases/download/$TAG/$ASSET_NAME"
+
 echo "Downloading from $DOWNLOAD_URL..."
 if ! curl -fL -o "$TMP_FILE" "$DOWNLOAD_URL"; then
     echo "Error: download failed from $DOWNLOAD_URL" >&2