Convert mobileInstall to artifact_processor (LAVA, context form); 729 lines -> 4 functions

[abrignoni]

Summary

The big pre-iOS-17 mobile_installation.log parser (729 lines). Was a single old-style function building 6 HTML reports via a temp SQLite db (mib.db) and per-bundle linked .txt files. Rewritten into four clean @artifact_processor functions.

Function	Artifact
mobileInstall_installed	Apps - Installed
mobileInstall_uninstalled	Apps - Uninstalled
mobileInstall_historical	Apps - Historical Combined
mobileInstall_reboots	State - Reboots

What changed

• Installed/Uninstalled = most-recent event per bundle id, partitioned by whether the latest action is a destroy/uninstall — computed in Python (no temp mib.db).
• Historical Combined = all parsed events. This is exactly the flat data the old per-bundle HTML-linked "Apps - Historical" report indexed, so that linked report (and the .txt files it wrote into the report folder) is dropped.
• Context form; pylint 10.00.
• LOCAL time (you flagged these): timestamps stored as-is, local-time stated in every notes; output_types excludes timeline.
• context.get_relative_path() on the returned source.
• Preserved all 7 event-type regexes (dropped the redundant Destroying container with identifier block that double-matched the plain one) and the sysdiagnose-tar extraction; hardened timestamp parsing + file/tar closing.
• Removed the dead/commented Strings - SQLite Journal report and ~500 lines of commented-out temp-db INSERTs/debug logging.

Validation

• ast.parse OK; 0 legacy refs (no sqlite3/mib.db); no cross-module imports; all 4 reserved-word audits clean.
• pylint (CI config): 10.00/10.
• Functional test on a fixture log: an app installed-then-uninstalled correctly appears only in Uninstalled (latest event wins), a still-installed app in Installed, all events in Historical, reboot in Reboots; source returned relative.