chore(phrocs): Auto-update phrocs binary on pnpm install

[charlesvien]

Problem

scripts/ensure-phrocs.sh only downloads bin/phrocs when it is missing, so the binary drifts behind the rolling phrocs-latest release until someone remembers to run pnpm update:phrocs.

Changes

A postinstall hook now runs ensure-phrocs.sh --update on every pnpm install: it fetches the release's checksums.txt, compares it against the local binary's sha256 and re-downloads on mismatch, with checksum verification (which the old script skipped). It never breaks pnpm install: network failures warn and keep the existing binary, and CI skips the check entirely. pnpm dev keeps a fast offline presence check that only downloads when the binary is missing. pnpm update:phrocs is removed since installs now keep the binary fresh.

How did you test this?

Ran both modes through all paths: ensure mode is instant with a binary present and downloads when missing, update mode is a no-op when checksums match, re-downloads a stale binary, skips under CI=1, and offline it exits 0 (keeping any existing binary) while ensure mode without a binary exits 1. shellcheck is clean and package.json parses.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[greptile-apps]

_{Reviews (1): Last reviewed commit: "auto-update phrocs on pnpm dev" | Re-trigger Greptile}

[github-actions]

Dev-only shell script adds checksum-based auto-update with HTTPS, verifies the downloaded binary before installation, cleans up temp files, and gracefully degrades when offline. The greptile bot's concern about the *-prefixed filename in GNU sha256sum output is addressed by the sub(/^\*/, "", name) awk expression, and that comment is marked resolved.

New commits pushed (delta classified non_trivial_delta) — stamphog approval dismissed; re-review running automatically.

[stamphog]

Gates denied this PR because it adds a postinstall hook that auto-downloads and executes a binary on every pnpm install, which is a supply-chain-sensitive toolchain change that requires human review before auto-approval.

[greptile-apps]

_{Reviews (2): Last reviewed commit: "update phrocs on pnpm install instead of..." | Re-trigger Greptile}