Replace zip with tar.gz for binary release artifacts

Our per-platform binary release artifacts (e.g. miren-linux-amd64.zip) use zip format, requiring unzip on the target system. Many minimal Linux distributions don't include unzip by default, making it an unnecessary dependency. tar is effectively universal on both Linux and macOS.

The server release download path (cli/commands/download_release.go) already uses tar.gz for the base release tarball — this would make the binary artifacts consistent.

Scope

runtime repo:

• hack/build-release.sh — switch from zip -j to tar -czf for creating per-platform archives
• .github/workflows/release.yml — produce .tar.gz artifacts instead of .zip; macOS notarization step uses zip transiently (that's fine, it's CI-internal)
• pkg/release/artifact.go — change artifact filenames from .zip to .tar.gz
• pkg/release/downloader.go — replace zip extraction with tar.gz extraction (can reuse existing extractTarGz from download_release.go)
• cli/commands/upgrade.go — update references to .zip artifacts
• pkg/release/artifact_test.go, pkg/release/metadata_test.go — update test expectations
• hack/systemd/Dockerfile.systemd — remove unzip from installed packages

cloud repo:

• services/installer/install.sh — switch download URLs from .zip to .tar.gz, replace unzip extraction with tar xzf, remove unzip from required tool checks

Notes

• Cloud asset storage is path-based so new .tar.gz filenames will just work once uploaded
• Need a transition plan if older clients expect .zip — could serve both formats briefly, or coordinate with a client version bump