Version mismatch between version.json and actual binary silent on partial install

[Widthdom]

Summary

After download_and_install() completes, version.json is installed but if the binary extraction fails or the binary move is incomplete, the next install check will read version.json (existing_install_is_reusable at line 438) and believe a complete install exists. The --version check at line 670 could return "0.0.0" if the binary wasn't actually extracted, yet the reusability check looks only at version.json presence. This creates a window where PATH now points to a degraded binary that reports success but has no runtime assets.

Where

• install.sh:438 (version.json existence check in existing_install_is_reusable)
• install.sh:500-559 (install staging with potential mid-flight failure)
• install.sh:765-805 (asset placement logic)

Suggested approach

1. Add a checksum validation of the installed binary against a manifest embedded in version.json
2. Include binary SHA256 hash in version.json generated during release packaging
3. After extraction, verify both binary presence AND match against the manifest before marking install complete
4. Add a "integrity_ok" flag or similar to version.json written only after all assets are in place
5. In existing_install_is_reusable, check the integrity flag in addition to version.json existence
6. If integrity check fails, treat install as incomplete and trigger a fresh install

[Widthdom]

Work started on branch fix-issue2040-2041-2012.