feat(installer): add conservative Linux uninstall

[kricha-lab-dev-worker]

Summary

• add root-only, no-argument forge uninstall bound to the exact currently installed CLI identity
• serialize uninstall with the hardened lifecycle lock and remove only release-owned immutable objects, direct systemd links, and the optional validated previous slot
• preserve configuration, secrets, SQLite, repositories, worktrees, runtime state, and the dedicated agent-forge account
• preserve exact prior service enabled/active state on handled failure; conditionally stop/disable Worker before Gate and recover Gate before Worker with readiness only for services that were previously active
• support systemd external-unit linked state and the case where successful systemctl disable removes the direct unit symlink
• fail closed on invalid current/slot/link/account/service state, ambiguous transaction material, and unrenamable filesystem or mount topology before service mutation

Transaction contract

• validates current receipt, immutable hashes/key set, ownership/modes/link counts, trusted ancestors, direct unit links, exact account identity, running CLI version/commit, and any previous slot before mutation
• probes enabled/active state through a bounded, fixed-argv systemctl show parser and rejects ambiguous states or Worker-active/Gate-inactive topology
• creates a private adjacent quarantine and preflights actual rename source/destination mount identity
• stop/disable order: Worker → Gate
• publication moves the five binaries, two unit files, receipt, and optional previous slot; mutable paths are never rename/delete targets
• removes exact direct links, reloads systemd, and verifies both services disabled/inactive before commit
• handled pre-commit failure restores slot/current objects/links, reloads systemd, restores exact prior service state Gate → Worker, and re-proves only services that were previously active
• post-commit cleanup removes only an exact bounded immutable set; partial residue is fail-closed and never triggers impossible rollback after partial deletion
• no purge, account deletion, secret rotation/output, reinstall adoption, or crash-atomicity promise

Verification

• go test -count=1 ./...
• go test -race -count=1 ./cmd/forge ./internal/linuxinstall
• go vet ./...
• go build ./...
• sh -n scripts/*.sh
• python3 scripts/linux-installer-diagnostics.py self-test
• workflow YAML parse
• git diff --check
• independent exact tracked+untracked tree security/correctness review

Privileged disposable CI extends the canonical pinned v0.1.3 → candidate → rollback → candidate → uninstall flow and proves inactive/disabled services, absent canonical release objects/slot/links, preserved mutable state and account records, and secret-free output.

Roadmap increment for #43. The issue remains open for online bootstrap/download, Homebrew Formula + macOS bottles, and the OCI Gate image.