Installer core with the Bob target #490

Problem

Bob users hand-place adept's files today (docs/bob-install-requirements.md). Epic #482
plans a curl | bash installer; this issue builds its core with Bob as the first target.

Evidence

• docs/bob-install-requirements.md §1 (tree for ~/.bob/ and <project>/.bob/), §2 (copy
  install is the only path where all scripts agree on ROOT), §5 (collision/idempotency).
• Justfile lint recipe lints every file scripts/list-shell-sources.sh discovers;
  suites sit beside their scripts under scripts/ (e.g. scripts/setup.sh,
  scripts/setup-test.sh).
• README.md:38-61 — current Install section.
• .claude/CLAUDE.md anatomy rule 3: every executable runs and exits.

Expected

The installer per epic requirement R5 and the ADR (#488): bash 3.2, set -euo pipefail,
only curl and tar; fetches refs/tags/v<version> (default latest, --version to pin);
--target bob, --scope global|project; copies the tree the Bob doc specifies; writes and
reads the placed-paths manifest; refuses on non-adept content; prints every path written;
idempotent; update replaces adept-owned files and removes ones deleted upstream. An offline
suite against a local tarball fixture covers install, re-run, update, and conflict refusal.
README documents the installer in the same PR.

Proposed approach

Structure the target table so #482's item 9 adds targets as rows plus suite cases. Bump
.claude-plugin/plugin.json (MINOR).

Part of #482
Blocked by #488
Blocked by #489