Installer: verify the Browser helper hash before sudo install #406

scripts/install.sh:908-926 copies a user-writable Browser helper to root with sudo on any Linux host with /dev/kvm (called at :952). Malware already running as the user could swap the file first.

Done means: the helper's hash is checked against the signed release before sudo install (or it ships root-owned).

Source: external audit of develop 55dcb79 (rev 3) verified independently by OMP and grook on 16 Oct. Related: #165, #288.

Acceptance record — 3 November 2026

The current #90 source snapshot 3a8f41c62 still copies the helper from the user's data directory with sudo install and then executes the root copy. Its printed manual command uses the same input. Source review confirms the existing finding on both paths. Prove that the exact bytes admitted by the signed manifest are the bytes the privileged step executes, including a replacement between validation and installation. Keep the explicit operator confirmation, removal and ordinary-user Runtime proof in #165/#90. Main owns the Linux release lane.