Report malformed release metadata without an installer traceback #174

Audited against merged master 13289d7a74ad45561554bbb6673a189dbb192a27 (PR #161).

Problem and reproduction

Several external JSON fields are indexed without shape validation. The top-level error handler does not catch resulting KeyError/TypeError exceptions, so malformed metadata can produce a Python traceback instead of the installer's normal diagnostic.

Reproduced by mocking the release API response to:

{"draft": false, "tag_name": "v0.0.2-beta"}

With host and gh discovery mocked, tools.install.main() raises KeyError('assets'). No download or destination replacement is needed to reach this failure.

Scope and acceptance

• Validate the release asset list and tag-object shapes before indexing fields that installation depends on.
• Produce a concise error describing the malformed response and missing/invalid field.
• Test missing assets, wrong container types, malformed asset entries and malformed tag objects using mocked responses.
• Leave any previous installation intact and preserve temporary-file cleanup.
• Do not mask programming errors with a blanket except Exception, relax official-URL checks or skip verification.

This covers response-shape handling; subprocess deadlines are a separate small fix.

Starting points

• tools/install.py:82
• tools/install.py:88
• tools/install.py:113
• tests/xpy/test_repository_contracts.py:53

This is a bounded follow-up suitable for a first contribution; no broader feature redesign is requested.