fix: make installation retries safe and predictable

[SaladDay]

Installation failures must be safe to retry, including after a killed process. Core now prepares configuration and pulls images before publishing its owned staging directory, preserves published configuration and data, and lets the original command rerun against saved settings. Startup failures include service diagnostics.

Node file writes share one temporary-file lifecycle across downloads, extraction, helpers, configuration and enrollment. Configuration is published atomically so killing a writer cannot leave a partial final file. Interrupted bytes are discarded instead of resumed; complete verified components remain reusable. The generated command checks prerequisites before downloading and separates disposable downloads from verified bootstraps. Native Runtime commands report missing Windows archive tools and Unix execution failures before claiming success.

Validation:

• Core installer: 20 tests, including SIGKILL, unrelated-directory preservation, concurrent operations, write limits, explicit image pulls, failed startup and retained data.
• Node artifact transport: 20 tests; 20 focused node lifecycle/helper tests (one root-only test skipped locally).
• Generated Node command: 15 tests; Web typecheck; affected add/remove Node browser acceptance tests.
• Native bootstrap suite on macOS arm64; shell syntax, documentation and translation checks.
• CI passed on the final commit: Linux, macOS and Windows native builds/bootstrap tests, Docker Compose, complete Linux distribution tests, backend/API checks, Web browser acceptance and documentation checks. Local Docker was unavailable.

Known limitation: a process killed between generation lease creation and publication of its durable inode identity requires operator inspection. Automatic lease adoption is intentionally outside this change: retaining the current refusal preserves Runtime helper exclusion without adding a second recovery state machine. The installer guide documents this boundary.

Additional validation: SIGKILL during installation.json, provider.json and registered.json writes, followed by successful retries; 16 focused configuration/registration/generation tests passed locally.

Independent review of the complete diff found no blocking issues under the agreed correctness and complexity criteria.