CLI silently downloads runtime tarball to ~/.mintlify without user consent

[dougEfresh]

Given the increased risk of supply chain attacks I consider this a security issue

You download a tar.gz file from releases.mintlify.com with zero signature verification and zero user prompt This isn't just files, it is code executed unknowingly by the user

It is a bit odd that you use npm as a bootstrap distribution. Why not include everything in the npm package?