cwc-makers: curl+tar fallback when git is missing

/maker-setup now falls back to GitHub's tarball endpoint when git isn't
on PATH, instead of detouring through a package-manager git install.
curl and tar ship with macOS, Linux, and Windows 10 1803+ out of the
box, so this is zero-install on every target platform — and a CwC
attendee just needs the files once to flash a device, not git history.

- maker-setup.md: git-clone fast path, curl|tar (Unix) / curl+tar+
  Rename-Item (PowerShell) fallback, normalizes the -main suffix
- m5-onboard/SKILL.md: drop git from required deps + per-OS git
  bootstrap block; keep Python bootstrap
- README: git now listed as optional

Linear: CC-1975

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

🏠 Remote-Dev: homespace

.github/workflows/bump-plugin-shas.yml

@@ -79,7 +79,7 @@ jobs:
           [[ "$DRY_RUN" = "true" ]] && args+=(--dry-run)
           python3 .github/scripts/discover_bumps.py "${args[@]}"
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+      - uses: oven-sh/setup-bun@v2
         if: steps.existing.outputs.count == '0' && steps.discover.outputs.count != '0' && inputs.dry_run != true
 
       - name: Validate marketplace.json

.github/workflows/validate-frontmatter.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+      - uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
         run: cd .github/scripts && bun install yaml

.github/workflows/validate-marketplace.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+      - uses: oven-sh/setup-bun@v2
 
       - name: Validate marketplace.json
         run: bun .github/scripts/validate-marketplace.ts .claude-plugin/marketplace.json