chore(install-remote): port logrotate, hook union-merge, Cellar layout from install

[bakeb7j0]

Resolves the kahuna→main trust-gate finding on Plan #581 PR #595: scripts/install-remote.sh (the documented curl | bash flow) was missing the three install-hardening features merged this campaign into install. This commit ports them so curl-bash users get the same on-disk shape.

Three features ported

• chore(logging): add logrotate policy for ~/.claude/logs/mcp.jsonl (currently 800 MB, no rotation) #540 logrotate: --with-logrotate / --without-logrotate flags + Linux-gated install_logrotate_config + --check drift detection. Uses the same tri-state mode as install.
• fix(install): union-merge hook matcher arrays in merge_settings() #556 hook union-merge: merge_settings() now union-merges matcher arrays for shared event keys, with --check reporting "missing matcher" drift. The jq pipeline is byte-equivalent to install's.
• fix(install): adopt Cellar + symlink-farm layout for orphan-free re-deploys #560 Cellar + symlink-farm: deploys to $CELLAR_DIR=~/.claude/scripts/ and farms top-level symlinks to ~/.local/bin/. Skill helpers namespaced under $CELLAR_DIR/skills/<skill_name>/<helper>. Portable find ... | sed 's|^\./||' pattern (no -printf — BSD/macOS).

Reviewer pass — initial findings, addressed in rework

Initial review surfaced 2 findings, both fixed via amended commit:

1. IMPORTANT (conf 85): added a post-farming sanity check that warns if expected prebuilt binaries are missing from the symlink farm (covers the case where a release tarball ships without dist/).
2. MINOR (conf 90): removed dead --check settings-drift stub (was just : with misleading comments). Replaced with explicit note pointing users to ./install --check from a checkout for full settings drift detection.

Re-review post-rework: both findings addressed, no new issues introduced.

Verification

• ./scripts/ci/validate.sh: 126 passed, 0 failed
• shellcheck scripts/install-remote.sh: clean
• pytest tests/test_install_remote_hardening.py -v: 10/10 passed
• macOS portability preserved: the one remaining -printf from install:690 was replaced in this port (in install-remote.sh) with a portable while+-nt loop and stat -c '%y' || stat -f '%Sm' fallback — actually better than reference for macOS.

Trust-gate context

Per WAVE_AXIOMS Axiom 5 (continuing cheaper than stopping), the gate-blocked PR #595 was kept open while this commit lands on kahuna. Once merged into kahuna, PR #595 will auto-update with this commit included; trust-gate code-reviewer signal should re-evaluate CLEAN.

🤖 Generated with Claude Code