test(installer): prove privileged Linux activation

[kricha-lab-dev-worker]

Summary

• add a fail-closed privileged Linux installer acceptance script restricted to clean disposable GitHub-hosted runners
• prove the real dedicated agent-forge account, /opt/agent-forge ownership and modes, systemd enable/start, and authenticated connected Worker
• prove same-version validation does not mutate immutable installation or service state, then restart Gate and Worker and re-prove readiness
• gate both pull-request CI and exact tagged release publication on this real privileged acceptance

Verification

• sh -n scripts/*.sh
• local fail-closed guard: PASS; no /opt/agent-forge mutation
• go test -count=1 ./... — 884 tests passed
• go vet ./...
• go build ./...
• scripts/release-artifacts-e2e.sh ef351413e483d6f5601867296a2c78762098ae6f
• scripts/linux-installer-e2e.sh v0.0.0 ef351413e483d6f5601867296a2c78762098ae6f "$PWD/dist"
• scripts/release-publication-e2e.sh

The new privileged path is intentionally executed only by GitHub Actions; exact-head CI is the real clean-runner RED/GREEN gate before merge.

Part of #43