Releases are not immutable

Describe the bug Direnv’s install script and recommended GitHub Actions usage instructions rely on GitHub release assets, but immutable releases is not turned on, so any released tag can potentially be rewritten, or released assets changed, in a software supply chain attack.

If immutable releases were turned on, then direnv version numbers would be guaranteed to always correspond to the same binaries.