fix(security): declare the printed install-script URL on the allow-list

The `update` handoff prints a curl one-liner when install.sh is not beside the
binary, and the security audit blocked the release on it:

  BLOCKED: src/cli/cli.c: URL not on allow-list: https://raw.githubusercontent.com/DeusData/

Two things were wrong. The URL was not declared, and it was split across string
literal continuations, so the audit extracted only the first fragment -- an
allow-list entry for the real URL could never have matched it. Hoisted to a
single CBM_INSTALL_SH_URL token so the declaration means what it says.

It is the same URL as the documented one-liner install, and it is printed for
the user to paste: the binary no longer downloads anything.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

src/cli/cli.c

@@ -11168,6 +11168,12 @@ static bool check_already_latest(void) {
 
 #endif /* CBM_CLI_ENABLE_TEST_API */
 
+/* One token on purpose: the security audit extracts URLs literally, so a URL
+ * split across string-literal continuations cannot be matched against the
+ * allow-list. Printed for the user to paste; never fetched by this binary. */
+#define CBM_INSTALL_SH_URL \
+    "https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh"
+
 int cbm_cmd_update(int argc, char **argv) {
     parse_auto_answer(argc, argv);
 
@@ -11257,8 +11263,7 @@ int cbm_cmd_update(int argc, char **argv) {
         if (have_dir) {
             printf("  bash \"%s/install.sh\"\n\n", self_dir);
         } else {
-            printf("  curl -fsSL https://raw.githubusercontent.com/DeusData/"
-                   "codebase-memory-mcp/main/install.sh | bash\n\n");
+            printf("  curl -fsSL " CBM_INSTALL_SH_URL " | bash\n\n");
         }
         printf("It downloads the latest release, verifies its checksum, and replaces\n"
                "this binary in place. install.sh is idempotent, so re-running it IS\n"