fix(installer): accept legacy release archive layout

[cyphercodes]

What does this PR do?

Fixes #1510.

install.sh now accepts the exact legacy four-member release archive layout used by the published v0.9.0/v0.9.x assets, while still keeping the canonical current runtime-asset layouts closed:

• standard: legacy 4-member archive or canonical 5-member archive
• UI: legacy 4-member archive or canonical 6-member archive with one content-addressed UI pack

The installer continues to reject unexpected archive members, duplicate/missing required core members, malformed UI pack names, and UI pack digest mismatches. The smoke fixture contract now covers the legacy standard/UI layouts and canonical UI layout through a loopback HTTP installer fixture.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

Local verification run:

• bash -n install.sh
• bash -n tests/test_smoke_fixture_contract.sh
• bash tests/test_smoke_fixture_contract.sh
• CBM_DOWNLOAD_URL=https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.9.0 bash ./install.sh --standard --skip-config with a temporary HOME, then installed binary --version
• CBM_DOWNLOAD_URL=https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.9.0 bash ./install.sh --ui --skip-config with a temporary HOME, then installed binary --version
• git diff --check HEAD~1..HEAD
• scripts/check-dco.sh HEAD~1..HEAD

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you for the installer compatibility patch and the clear link to the affected reports. I have routed it as a high-priority installer bug for the immediate train. The branch currently conflicts with main, and the v0.10.0 installer and release layout changed after this PR opened, so the eventual review will need to evaluate the patch against that current contract. The queue is full, but we will come back with detailed feedback.

[DeusData]

Reviewed — thank you @cyphercodes. Same note as #1512: the failing check is cli_concurrent_ui_then_standard_install_leaves_coherent_standard_set, a test that no longer exists on current main (removed with the single-composition consolidation), so this red is a stale base rather than your change. Please rebase on main and we'll merge — happy to do the rebase for you if you'd rather.

Related: we're also shipping ui-* alias assets on releases (#1538) so already-shipped 0.9.x updaters stop 404ing; your legacy-layout acceptance and that alias publishing solve the two halves of the same upgrade problem.

[cyphercodes]

Rebased on current main and resolved the installer/smoke-contract conflicts around the single-composition release layout. Kept the Unix installer accepting the exact four-member legacy/current archive shape while retaining the current tar --no-same-owner extraction behavior.

Verification run locally:

• bash -n install.sh tests/test_smoke_fixture_contract.sh
• bash tests/test_smoke_fixture_contract.sh
• git diff --check upstream/main...HEAD