Add script/install; script/update-policy runs it and commits (closes #165)

script/install fetches the policy files from prompts over HTTP and
writes them into a repo, installing itself and script/update-policy
there. script/update-policy fetches the current script/install, runs
it on its own repo and commits without pushing. The file list and the
rules for keeping a repo's own entries move to script/install.

Model: opus-5-5

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks update-policy
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks install update-policy
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -31,5 +31,8 @@ docker:
 hooks:
 	@script/install-precommit
 
+install:
+	@script/install
+
 update-policy:
 	@script/update-policy