[KSlashh]

Audit items M39 and M40. Open against dev.

install-bitvm.sh (M39). The script installed nothing, and every skill that calls it (upgrade, pegout, pegin-request, challenge, run-*-node) failed with it:

• The .sha256 files list the archive as release-artifacts/<archive>, so sha256sum -c in the download directory found nothing and set -e exited.
• The default install directory ./bin was resolved inside the temporary directory, which the EXIT trap then deleted.
• The EXIT trap referred to a function-local variable, which is unset by the time the trap runs (set -u error).
• Every published release (up to v0.3.3) names its archives bitvm2-node-*, while the script asks for bitvm-node-*.

Fixes:

• The install directory is made absolute before anything else.
• The checksum is compared by hash, which works for both the old and the new .sha256 format. release.yml now writes only the archive name.
• The trap expands its path when it is set.
• The script falls back to the former archive name.

Checked by installing v0.3.3 from GitHub with the default --dir ./bin.

Toolchain and image tags (M40).

• ci.yml pinned the zkmup commit and toolchain version. release.yml, docker.yml and the proof-builder image workflow ran setup.sh from the toolchain repository's main instead, so releases were built with a toolchain CI never tested, and a change to that repository went straight into them. All four workflows now use one composite action, .github/actions/install-ziren, which holds the pinned commit and version. The pinned version also ships the aarch64 macOS build that release.yml needs.
• Both image workflows pushed :<Cargo version> on every dev push, so an operator pinned to 0.4.0 pulled unreleased dev builds. The version tag is now pushed only from main; other pushes tag dev-<sha>. :latest is unchanged.

Review notes

• The image and release workflows run only on push or tag, so this PR's CI exercises the composite action through ci.yml only.
• Anyone who deploys a dev image by version tag needs to switch to dev-<sha> or latest.

The test coverage and validation notes above are from the zkm PR notes. Branch scope and diff formatting were checked locally; builds and tests were not rerun during publication.