[andersalm]

Part of #108

Re-running install.sh used to replace the Runtime, the trusted source and the signed release pair before any check, so an older installer could overwrite a newer installation.

What changes:

• install.sh hands the verified Runtime, trusted source and signed pair to Runtime's installation writer (the same lock and journal elastos update uses). It no longer writes those files itself.
• A writer check runs before install.sh stops Runtime. It restores an interrupted install, then checks the signatures against the installer's key, the binding, the binary checksum, version order, channel and install path. It refuses an older release, a pending Home update, a second writer, and an installed Runtime whose sources.json is missing or unreadable. Every refusal happens before "Stopping verified Runtime processes", so a refused run changes nothing and leaves Home running.
• One journaled transaction then replaces the files. If it is interrupted, Home does not start and asks you to run install.sh again; that re-run restores the previous state and completes.
• An install.sh run with a new maintainer key is the explicit re-trust for an old Home (old layout, old key). elastos update on that Home still refuses the new key and now says to run install.sh.
• --allow-unsigned is removed. Nothing used it, and the writer requires signatures.

Why the hidden install-release command is not a new authority: it runs as the same user who owns the Runtime binary, its data directory and sources.json. That user can already rewrite sources.json directly or re-trust with elastos source add. The command only adds checks before the same writes. Limiting it to the DID stamped in install.sh would not help, because install.sh passes that DID itself.

What a user sees:

• Fresh installs print the same lines as before.
• A refused re-run stops with a plain reason, for example "Release X is older than the installed release Y; this installation was not changed."
• A staged binary that fails its version check no longer stops Runtime first.

Tests:

• cargo test -p elastos-server --lib update::tests::installer (7 tests): an older installer after a real update; a pending Home update (restart journal and queued request); a fresh install, then a concurrent writer; the legacy first hop (update refusal, interruption after activation, re-trust); an interrupted fresh install that blocks Home and that a re-run completes; an installed Runtime with no readable sources.json; a tampered binary and foreign head/release signers. Each refusal leaves every file unchanged.
• cargo test -p elastos-server --lib -- install_transaction installed_release update sources:: host_lock (skips one test that binds port 8090)
• python3 scripts/install-bootstrap-test.py. It runs the real install.sh with mocks and checks that the writer check, the Runtime stop, the install and the root upgrade happen in that order, and that a writer refusal stops before Runtime.
• Smoke: the real install.sh with a real dev Runtime (mocked curl): a fresh install, a same-version re-run, and refusals for --allow-unsigned, older-over-newer, a corrupt and a missing sources.json, and a concurrent writer. None of the refusals stopped Runtime or changed a file. The develop install.sh overwrote the newer installation.