fix(installer): neutral Tier-1 rootless header — drop the early no-admin promise

[LukasWodka]

Fixes the Bugbot finding on the staging promotion (#480 thread): the Tier-1 rootless branch promised no administrator rights needed before _ensure_subid_ranges / _ensure_cgroup_delegation ran — on hosts where either applies, that promise is immediately contradicted by an announced sudo touch or a prepare-host handoff.

• Header is now neutral: Setting up a rootless container runtime (user-space install). — the two prerequisite helpers announce themselves (or hand off) only when they actually fire, so no message ever overpromises.
• Tier 0's identical claim is unconditionally true (runtime already present, docker-group user) and is untouched.
• scripts/manifest.sha256 regenerated (R8 gate).

One-line copy change + manifest; no behavior change.

---

Note

Low Risk
User-facing log text and checksum manifest only; no install behavior changes.

Overview
Fixes misleading installer copy on the Tier-1 rootless path (_rootless_active in setup-linux.sh): the status line no longer claims no administrator rights needed before _ensure_subid_ranges or _ensure_cgroup_delegation run, which can still trigger sudo or a prepare-host handoff.

The message is now Setting up a rootless container runtime (user-space install)., with an inline comment documenting the Bugbot/#480 rationale. Tier 0 still uses the unconditional no-admin line; install logic is unchanged.

scripts/manifest.sha256 is updated for the touched setup-linux.sh (R8 gate).

^{Reviewed by Cursor Bugbot for commit 2d69b21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 35 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc  #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI) #221) · author: @divyasinghds · no reviewer assigned
• averaging-service#234 — release-train: develop -> staging · author: @LukasWodka · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1338 — release-train: develop -> staging · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[divyasinghds]

Log-text-only change + regenerated manifest.sha256; E2E/prereq matrix all green. Neutral rootless header no longer overpromises 'no admin' before the two conditional privileged prerequisites fire. Tier 0's unconditional claim correctly left untouched. LGTM.