fix: harden start.sh - #7003

Downloads:
- TLS certificates are verified and a failed request leaves no file.
- Release jars must carry a valid GPG signature from the release key
  listed under "Integrity Check" in README.md. A jar that fails is not
  used: --upgrade keeps the old jar and --download the existing one.
- The mainnet config comes from java-tron and the Nile config from
  nile-testnet.

Bugs:
- --stop looped forever, the node was restarted two or three times per
  run, and -c was passed again on every start.
- A jar argument such as my.jar was ignored, and -j with a path lost
  the path before starting.
- --net ignored an existing config file; --net and --release kept
  going after a failed download.
- Linux heap sizing needed bc, and the macOS memory check failed with
  an expr error.
- Manifest rebuilding used a wrong URL and never ran the plugin. It
  now runs and, by default, rewrites manifests of 128 MB or more.
- The latest release was picked in name order, clone failures were
  ignored, $darwin was never set, and failures exited with status 0.

Platforms:
- start.sh reads the Java version and architecture of its JVM. JDK 8
  keeps the CMS options and JDK 17 uses the ZGC options from
  start.sh.simple, which is removed. ARM64 downloads the aarch64 jars
  and skips manifest rebuilding.
- -s stops the node and the open file limit is raised to 65535, as in
  start.sh.simple. The default JVM_MX, used on macOS, is 12g.

README and shell.md describe the single script.

Downloads:
- TLS certificates are verified and a failed request leaves no file.
- Release jars must carry a valid GPG signature from the release key
  listed under "Integrity Check" in README.md. A jar that fails is not
  used: --upgrade keeps the old jar and --download the existing one.
- The mainnet config comes from java-tron and the Nile config from
  nile-testnet.

Bugs:
- --stop looped forever, the node was restarted two or three times per
  run, and -c was passed again on every start.
- A jar argument such as my.jar was ignored, and -j with a path lost
  the path before starting.
- --net ignored an existing config file; --net and --release kept
  going after a failed download.
- Linux heap sizing needed bc, and the macOS memory check failed with
  an expr error.
- On macOS without JAVA_HOME the script derived JAVA_HOME=/usr from the
  /usr/bin/javac stub, and /usr/bin/java then ran itself forever; the
  JDK now comes from /usr/libexec/java_home.
- Manifest rebuilding used a wrong URL and never ran the plugin. It
  now runs and, by default, rewrites manifests of 128 MB or more.
- The latest release was picked in name order, clone failures were
  ignored, $darwin was never set, and failures exited with status 0.

Platforms:
- start.sh reads the Java version and architecture of its JVM. JDK 8
  keeps the CMS options and JDK 17 uses the ZGC options from
  start.sh.simple, which is removed. ARM64 downloads the aarch64 jars
  and skips manifest rebuilding.
- -s stops the node and the open file limit is raised to 65535, as in
  start.sh.simple. The default JVM_MX, used on macOS, is 12g.

README and shell.md describe the single script.

Adds comments to the Java detection, the release download and signature
check, the memory sizing, the manifest rebuild and the option handling of
start.sh, describing what each branch does. JVM_MX drops from 12g to 9g;
Linux derives the heap from the total memory, so the default applies to
macOS only.

start.sh had several problems that predate this branch:

- --stop matched every process whose command line contained the jar name
  and dropped any line containing "start", so it could kill other nodes and
  miss its own. The node id is now kept in <jar name>.pid; a directory with
  a start.log but no pid file was used by the old script and its node is
  still found by name. --stop also finds a node set up by --release or -cb
  from the parent directory, and says so when no node was started from the
  current one.
- sh start.sh failed under dash; the script now reruns itself under bash.
- an option without its value looped forever; needValue exits instead.
- --disable-rewrite-manifest was only accepted as --disable-rewrite-manifes.
- the first unknown option swallowed all following arguments; each unknown
  token is now passed on and parsing continues, with -- as an explicit end.
- paths with spaces broke unquoted expansions; FullNode options are an
  array now.
- --release downloaded straight onto FullNode.jar; it now uses a temporary
  file like --upgrade.
- gc.log was archived before the node was stopped, and by --download.
- a JDK that exists but cannot run went unnoticed, and a JVM that died
  right after the start was reported as running.
- the manifest rebuild looked for the database next to the caller instead
  of the node directory, --net stored a relative config path, the gc log
  rotation deleted unrelated files, ulimit lowered a higher limit, and the
  rebuild message named logs/archive.log instead of logs/toolkit.log.

shell.md documents the pid file, -- and the corrected option spelling.

Fold the logging helper of the removed start.sh.simple into start.sh:
info/warn/error print a timestamped, colored line to the terminal
(ERROR on stderr) and append the same line, without color codes, to the
start.log beside the JVM output. Lifecycle messages (stop, upgrade,
download, signature check, rebuild, start) are then preserved when the
script runs from cron, systemd or nohup instead of being lost with the
terminal. Messages a function returns on stdout are left as plain echo.