feat(install): add command that installs and pins deps in .bashdep

[Chemaclass]

Why

Checksums are opt-in, and pinning one by hand means download, shasum, copy, paste. Most people skip it.

What

bashdep add <url...> installs the URL and appends it to .bashdep with #sha256= from the downloaded file.

./lib/bashdep add https://github.com/Chemaclass/bash-dumper/releases/download/0.1/dumper.sh@dev
# .bashdep gains: .../dumper.sh@dev#sha256=1bcf30...

• Creates .bashdep when missing. Respects --file.
• Keeps the @dev suffix before the checksum.
• URL already listed: installs it, does not append again.
• Explicit #sha256=: verified and kept as given.
• Failed download: nothing written. Exit code is the failure count.
• Honors dry-run, silent, verbose, force. In --help and completions.

The pin is trust on first use. Documented in behavior.md.

Test plan

• 15 new tests (file write, dev suffix, dedup, dry-run, failures, CLI, completion)
• Manual run against a real release URL on bash 3.2
• make check green