Make local install failures and prerequisites actionable

[sdairs]

Summary

• Preserve the requested path and underlying OS cause when install and atomic staging directories cannot be created.
• Replace the Linux host tar subprocess with selective in-process extraction using the existing flate2 and tar dependencies, while retaining archive, destination, malformed-input, and missing-binary context.
• Expand local install --help with version examples, the binary destination, source hosts, the approximate download size, and the bare local server start bootstrap route.

Tests

• cargo test -p clickhousectl
• cargo test -p clickhousectl --no-default-features
• cargo test -p clickhousectl version_manager::install::tests
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings

Stack

• Position: 4 of 4
• Base: issue-456-atomic-installs (Make local ClickHouse installs atomic and concurrency-safe #502)
• GitHub stack: #497

Closes #462

_{Stack created with GitHub Stacks CLI • Give Feedback}

[macroscopeapp]

🟠 High version_manager/install.rs:379

A corrupted gzip download can be accepted as an installed clickhouse binary: this return Ok(()) runs immediately after copying the matching entry, so GzDecoder is dropped before validating the gzip trailer CRC and size. For exact versions, install_resolved then commits the corrupted executable without running version detection. Consume and validate the archive to EOF before publishing the output, preferably by writing to a temporary file and renaming it only after validation.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @crates/clickhousectl/src/version_manager/install.rs around line 379:

A corrupted gzip download can be accepted as an installed `clickhouse` binary: this `return Ok(())` runs immediately after copying the matching entry, so `GzDecoder` is dropped before validating the gzip trailer CRC and size. For exact versions, `install_resolved` then commits the corrupted executable without running version detection. Consume and validate the archive to EOF before publishing the output, preferably by writing to a temporary file and renaming it only after validation.