ci(install): gate the remote install path end to end (#906)

* ci(install): gate the remote install path end to end

A curl|bash user takes a different path than the local install gate
covers: bootstrap outside a checkout, tag selection, clone/fetch of the
selected tag, then handoff to the tagged installer with the original
arguments. Add scripts/install-remote-test.sh, which publishes HEAD as a
tag in a local mirror, runs install.sh against it twice (fresh clone,
then fetch+reset of the existing clone), and fails closed when the
clone's HEAD is not the selected tag commit. install.sh gains a
VOCALINUX_REPO_URL override so the mirror can stand in for the public
remote. Wire a single-distro job into the distro matrix and a just
remote-install-gate recipe.

Refs #701

* ci(install): publish the gate tag as an orphan from HEAD's tree

CI checks out with fetch-depth 1, and git refuses to push or fetch a
shallow boundary commit into a ref. Build the tag on an orphan commit
created from HEAD's tree instead, and make tree equality the fail-closed
check that installer, modules and exports are this commit's files.

* test(install): force the re-run arm to prove fetch and reset

Review feedback on the remote-install gate: the second run reused a clone
already on the tag, so a broken fetch or reset would still pass. Move the
clone onto a descendant commit and delete its local tag ref before the
re-run, so only a real fetch + reset restores them. Also list the new
recipe in AGENTS.md's command guide.

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

.github/workflows/distro-test-matrix.yml

@@ -90,3 +90,32 @@ jobs:
             -v "$PWD:$PWD:ro" -e REPO="$PWD" \
             "${{ matrix.container }}" \
             bash "$PWD/scripts/install-test.sh"
+
+  # The install matrix gates the local path: it hands install.sh a checkout.
+  # A curl|bash user takes a different one — bootstrap outside a checkout, tag
+  # selection, clone, handoff to the tagged installer — which scripts/
+  # install-test.sh's own header admits it does not cover (#701). One container:
+  # the remote-only half (bootstrap, tag, handoff) is distro-agnostic, and the
+  # tagged installer's per-distro work is already covered by the matrix above.
+  install-remote:
+    name: remote install.sh on debian:12
+    runs-on: ubuntu-latest
+    needs: syntax
+    # Two sequential remote installs (fresh clone, then fetch+reset) plus a
+    # real package install on each.
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The gate publishes HEAD as a tag in its mirror; it needs the
+          # commit's objects, not history.
+          fetch-depth: 1
+
+      - name: Run the remote install path in debian:12
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "$PWD:$PWD:ro" -e REPO="$PWD" \
+            debian:12 \
+            bash "$PWD/scripts/install-remote-test.sh"