Add install script, release Makefile and self-update

Releases are built locally (no runner) and uploaded to the Gitea generic
package registry. install.sh installs submarine plus a sub symlink;
`submarine update` replaces the binary after verifying its checksum.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.template

@@ -0,0 +1,8 @@
+# Copy to .env (gitignored); the Makefile loads it automatically.
+
+# Access token with write:package scope. Required for `make release`.
+GITEA_TOKEN=
+
+# Optional overrides (defaults shown).
+# GITEA_URL=https://git.simon-franken.de
+# GITEA_OWNER=simonfranken