fix(install): unbreak curl|bash one-liner (regression in v1.8.0)

Two bugs at the curl|bash entry point made the headline install command
fail immediately:

1. install.sh used `${BASH_SOURCE[0]}` under `set -u`. That variable is
   unset when bash is invoked from stdin (curl | bash), tripping the
   nounset trap before we ever reached the npx fallback.
2. install.sh + install.ps1 passed `--` between npx and the package args.
   On modern npm, npx forwards the literal `--` to bin/install.js, which
   parseArgs rejected as an unknown flag.

Fix:
- install.sh: default BASH_SOURCE[0] to empty so the curl-pipe path falls
  through cleanly under set -u.
- install.sh + install.ps1: drop the `--` separator. npm 7+ npx already
  forwards trailing args correctly.
- bin/install.js parseArgs: accept a bare `--` as a no-op (POSIX
  end-of-options marker) so future shim drift can't re-break this.
- New regression test asserts `--` is accepted.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

install.ps1

@@ -55,5 +55,8 @@ if (-not $npx) {
   exit 1
 }
 
-& npx -y "github:$Repo" -- @Args
+# Do NOT pass `--` here — npm 7+ npx already forwards trailing args to the
+# package, and a literal `--` was tripping bin/install.js's parseArgs as an
+# unknown flag.
+& npx -y "github:$Repo" @Args
 exit $LASTEXITCODE