feat: tag-based version alias retrieval (v1 moving major)

Summary

MAKERAILS_VERSION now accepts any git reference, used verbatim — including a moving major alias like v1 that tracks the newest v1.x.y release. Re-running make get-makerails re-resolves the alias with no Makefile edit.

Changes

• Downloader fetches the downloader script from the raw endpoint (/-/raw/<ref>/...) and the module payload from the repository-archive endpoint (/-/archive/<ref>/...?path=src/makerails), replacing the old release-downloads URL that only worked for published GitLab Releases.
• Download + extraction is staged under .makerails/cache/ and swapped atomically, so an unresolvable reference fails without disturbing an existing .makerails/ install (FR-006).
• makerails-install.sh generates the matching raw-endpoint get-makerails block.
• README documents alias vs exact-tag pinning.
• Removed dead commented deps-extended lines in main.mk.
• Added BATS coverage for archive retrieval, alias refs, atomic swap, and failure isolation.
• Added spec-kit artifacts under specs/003-tag-based-version-alias/.

Root cause this fixes

Consumer projects pinned to alias v1 failed make get-makerails: the old downloader hit /-/releases/v1/downloads/... (404 — no GitLab Release named v1). The archive endpoint resolves any git ref, so aliases work.

Follow-up (release side)

After merge: cut the release and point the v1 alias tag at it, so the v1 ref serves this new downloader.