Prefer releases.openai.com in standalone installers

[copyberry]

Prefer releases.openai.com in standalone installers

What changed

• Make the shell and PowerShell installers download release metadata and assets from releases.openai.com by default, with bounded request timeouts.
• Fall back to GitHub Releases when metadata is unusable, required assets are missing, or downloaded assets fail checksum or manifest validation.
• Document CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false for opting out of the default release source.

Testing

• Cover default-source installation, malformed and incomplete metadata, version mismatches, corrupt assets, invalid checksums, incomplete manifests, and GitHub fallback failures in the shell installer tests.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}