fix(security): declare the printed install-script URL on the allow-list

The `update` handoff prints a curl one-liner when install.sh is not beside the
binary, and the security audit blocked the release on it:

  BLOCKED: src/cli/cli.c: URL not on allow-list: https://raw.githubusercontent.com/DeusData/

Two things were wrong. The URL was not declared, and it was split across string
literal continuations, so the audit extracted only the first fragment -- an
allow-list entry for the real URL could never have matched it. Hoisted to a
single CBM_INSTALL_SH_URL token so the declaration means what it says.

It is the same URL as the documented one-liner install, and it is printed for
the user to paste: the binary no longer downloads anything.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/security-allowlist.txt

@@ -66,6 +66,7 @@ src/ui/http_server.c:execl:exec indexing binary in child process
 URL:https://api.github.com/repos/DeusData/codebase-memory-mcp/releases/latest:update check
 URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest/download:binary download + checksums
 URL:https://github.com/DeusData/codebase-memory-mcp/releases/latest:version check via redirect header
+URL:https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh:printed by `update` as the install-script command when install.sh is not beside the binary (a string in the message, not a network call - the binary no longer downloads anything)
 URL:http://127.0.0.1:UI server binding (localhost only)
 URL:https://www.sqlite.org/c3ref/c_checkpoint_full.html:sqlite WAL checkpoint API doc reference (comment only, not a network call)
 URL:https://github.com/DeusData/codebase-memory-mcp:project repository self-reference in update/star notice (src/mcp/mcp.c)

src/cli/cli.c

@@ -11168,6 +11168,12 @@ static bool check_already_latest(void) {
 
 #endif /* CBM_CLI_ENABLE_TEST_API */
 
+/* One token on purpose: the security audit extracts URLs literally, so a URL
+ * split across string-literal continuations cannot be matched against the
+ * allow-list. Printed for the user to paste; never fetched by this binary. */
+#define CBM_INSTALL_SH_URL \
+    "https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh"
+
 int cbm_cmd_update(int argc, char **argv) {
     parse_auto_answer(argc, argv);
 
@@ -11257,8 +11263,7 @@ int cbm_cmd_update(int argc, char **argv) {
         if (have_dir) {
             printf("  bash \"%s/install.sh\"\n\n", self_dir);
         } else {
-            printf("  curl -fsSL https://raw.githubusercontent.com/DeusData/"
-                   "codebase-memory-mcp/main/install.sh | bash\n\n");
+            printf("  curl -fsSL " CBM_INSTALL_SH_URL " | bash\n\n");
         }
         printf("It downloads the latest release, verifies its checksum, and replaces\n"
                "this binary in place. install.sh is idempotent, so re-running it IS\n"