Add script/install; script/update-policy runs it and commits (closes #165)

script/install fetches the policy files from prompts over HTTP and
writes them into a repo, installing itself and script/update-policy
there. script/update-policy fetches the current script/install, runs
it on its own repo and commits without pushing. The file list and the
rules for keeping a repo's own entries move to script/install.

Model: opus-5-5

README.md

@@ -141,9 +141,12 @@ alpine. We provide:
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own
   extension); `make hooks` shims to it
-- `script/update-policy` — fetch the vendored policy files from this repo,
-  commit them and push (our own extension); it is for the repos that vendor them
-  and stops when run here
+- `script/install` — fetch the vendored policy files from this repo over HTTP
+  and write them into the repo given as its argument, or its own repo with no
+  argument (our own extension); it stops when run here
+- `script/update-policy` — fetch the current `script/install`, run it on its own
+  repo and commit the result without pushing (our own extension); it is for the
+  repos that vendor the policy files and stops when run here
 
 `make hooks` installs the pre-commit hook that runs `script/precommit`.