[rmcdaniel]

Fixes #55. Addresses five reviewed Sonar findings linked there.

Restrict the initial curl transfer and every redirect to HTTPS in the build
helpers, public release-asset check and pinned-SPC release download. Require a
binary wheel for the already pinned PyYAML policy dependency.

Tool versions, checksums, retry policies, target URLs and package metadata are
unchanged. This is source/CI hardening; no CLI version or release asset is
published by this PR. Ordinary CLI checks and exact-source Sonar review remain
required before merge.

Local qualification passes Bash syntax, 15 existing release metadata/channel
contracts, all four workflow YAML files and the current central action policy.
The actual hardened public-asset checker reads the published 2.2.3 install.sh
successfully using curl 7.88.1. These are source/tooling controls, not native
binary or new-release qualification.

First head e964891 introduced an unquoted YAML colon in the pip command.
GitHub rejected 39024984352
before any job; the same syntax error was reproduced locally. The next source
93d312a passed YAML, central policy, PHAR smoke/reproducibility and release
contracts, but its four PHP jobs
failed. The audited PHP 8.3 run reports one source-contract failure out of 912
tests / 17,316 assertions. That assertion
required curl's HEAD/retry flags immediately after the command name. The
correction preserves those required flags while permitting the protocol guards.
Both original failed runs are preserved.

Reviewed head 84f47a09f5419fb66585eb27430d8e7cb6f9bc67, whole tree
5ba4b42bdd8c5d1506c7ae9037a9b1500909ae74, has fresh
Build and
Sonar
checks passing. All eight build jobs, both boundaries and the official Sonar
app pass on this revision. Direct API review has zero open/confirmed PR
findings, zero new duplication and all hotspots reviewed under unchanged
thresholds. PHP syntax for the adjusted source-contract test passes.

Merged as 88ebad257df20b63f399675a88085cbefb612d1f with the identical reviewed
tree and parents a10f9485 / 84f47a09. The remote head is deleted and verified
404. Independent main Build
passes all eight jobs, and Sonar
plus its official app pass on exact merge 88ebad25. Immutable main analysis
9cbf2794-98c4-48c9-b160-328f6a91355e matches that revision. All five targeted
reports are independently read back as CLOSED/FIXED. The
automatic native cache qualification
also passes all four native platforms on its original run, including macOS 15
ARM64. Release-only packaging and signal checks skip in cache-warm mode. No
new CLI version or public release asset is published. Completed local source,
branches and all task resources are retired.

Sonar's one minor suggestion to extract the repeated =https tool option into
a constant is explicitly accepted with a scoped reason: the initial-transfer
and redirect restrictions stay visible at each download call. No rule,
quality profile, threshold or security finding is waived.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud