install.sh was only syntax-checked (sh -n), so the install and upgrade paths,
the config-preservation contract and the failure modes for a malformed release
tarball had no coverage. Add an offline, unprivileged E2E test that builds its
own tarballs and installs into a temp prefix with --service none: fresh
install, an in-place upgrade that keeps an operator-edited config, --with-server,
a dry run that creates nothing, three malformed tarballs that must fail closed,
and the CLI surface. Wire it into make test as test-install and syntax-check
the new script.
