refactor(installer): scrub remaining internal identifiers from bootstrap messages (#581)

[shujaatTracebloc]

What & why

Closes#581. Follow-up from the #576/#579 review (saadqbal). #579 sanitized the cosign verification-failure message; this sweeps the remaining, lower-signal internal identifiers still present in user-facing bootstrap messages — the manifest.sha256 release-asset filename and the RFC-0001 R8 internal spec code — to plain language, for consistency with #576.

No behaviour change: fail-closed paths, verification logic, and exit codes are untouched — only the wording of echo/throw/Warn strings changes.

Changes

• install.sh — manifest.sha256 → "the installer's integrity checksums" / "the installer's signed checksum list"; .sig/.cert not published / "authenticate the manifest" → "the installer's signature isn't published" / "confirm the download is authentic"; "signed manifests" → "signed releases".
• install.ps1 — same wording, plus (RFC-0001 R8) removed from every throw (Resolve-InstallRef, Confirm-ManifestSignature, Confirm-ScriptIntegrity, the temp-dir guard).
• Deliberately left untouched:RFC-0001 in code comments (not user-facing) and the actual manifest.sha256file paths / URLs (the real release assets).
• Tests: updated the two pinned assertions (install-bootstrap.bats + install.Tests.ps1) from "no entry in manifest" to "isn't in the installer's signed checksum list".

Verification

• No internal identifiers left in any user-facing message (grep of echo/printf/throw/Warn/Err — clean).
• Parse clean (bash + PS); install.Tests.ps1 28/0; install-bootstrap.bats green (the one failure is the pre-existing macOS "early bailout" flake); bats-hygiene 18/0; fail-closed + no-entry security tests still pass; check-style clean.
• install.sh/install.ps1 are the bootstrap trust root (not manifested) — no manifest change.

Note

Completes the #576/#577/#578 installer-robustness log-hygiene tail. Touches the same install.sh/install.ps1 verify messages as #584 (#599); whichever merges second will need a small message-wording merge — I'll resolve it.

---

Note

Low Risk
Copy-only changes to installer error/warning strings and matching test assertions; no changes to verification logic or security gates.

Overview
Continues the #576 installer log-hygiene work by rewriting user-facing bootstrap errors and warnings in install.sh and install.ps1 so they no longer mention internal artifacts like manifest.sha256 or the RFC-0001 R8 spec code.

Messages now talk about the installer's integrity checksums, signed checksum list, and installer signature instead of manifest filenames and “authenticate the manifest.” PowerShell throws also drop the (RFC-0001 R8) suffix on ref, path-traversal, cosign, and integrity failures. Comments and real release URLs/paths for manifest.sha256 are unchanged.

Tests (install-bootstrap.bats, install.Tests.ps1) only update expected substrings for the new copy. Verification logic, fail-closed behavior, and exit codes are untouched.

^{Reviewed by Cursor Bugbot for commit 80333ba. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c18c1f0. Configure here.}

[saadqbal]

Clean scrub, tests updated on both sides and the assertions match the emitted strings exactly. One consistency nit inline — non-blocking. 👍