fix(npm): pin install to the bootstrapper's version, not main

[fujibee]

Summary

npx agmsg@X (and an installed agmsg@X) currently installs whatever is on main, ignoring the pinned version. Both layers of the bootstrapper were hardcoded to main:

1. bin/agmsg.js fetched setup.sh from .../fujibee/agmsg/main/setup.sh.
2. setup.sh ran git clone --depth 1 … with no ref (default branch = main).

Fix

• bin/agmsg.js: derive the ref from the bootstrapper's own version (v${version}), fetch setup.sh from that tag, and pass AGMSG_REF to setup.sh. Falls back to main when the version can't be read.
• setup.sh: read AGMSG_REF (default main) and git clone --depth 1 --branch "$AGMSG_REF", with a clean error if the ref can't be cloned.

Verification

• node --check bin/agmsg.js; --version / --help / unknown-arg exit code all correct.
• installRef() resolves 1.0.5 → v1.0.5 → correct setup URL + AGMSG_REF.
• Tag-pinned clone proven against a real tag (--branch v1.0.4 yields VERSION 1.0.4, not main); a bogus ref fails cleanly.
• Full bats suite: 345/346 pass. The single failure (watch: closed consumer does not advance watermark past an undelivered row) is pre-existing on main and environment-specific (SIGPIPE/head timing), unrelated to this change.

Known limitation

Bootstrappers published at or before 1.0.5 hardcode main and cannot be retrofitted; npx agmsg@1.0.5 will still pull main. Pinning holds from the first release that ships this fix (1.0.6) onward.

Closes #172