feat(install): route the per-module install queue through InstallServ…

[luisguzman-adfa]

…ice (ADFA-4476 slice 3)

Slice 1 moved the module-grid selection to the Activity-scoped ViewModel; slice 2 moved the scratch reset into the service. This slice moves the last Fragment-bound long op -- the per-module install queue -- into the foreground InstallService, so the service (not the Fragment) is the single owner of the loop.

Root cause it closes: the queue loop lived in InstallController with a Fragment-scoped re-entry flag (installInFlight), and DeployFragment.onResume() re-fired processNextInQueue() after a recreation. A theme toggle mid-install recreated the Activity, installInFlight was born false, and onResume launched a SECOND concurrent runrole in the same rootfs -> corruption. The ADFA-4519 stop-gaps (installingModuleKeys guard + in-flight display) mitigated it; this removes the cause: the service keeps advancing the queue regardless of the Fragment lifecycle, and there is never more than one runrole in flight.

• ModuleQueueState + ModuleQueueRepository: app-scoped observable of the queue (current module, remaining, failed set, seq), mirroring InstallProgressRepository. Kept separate from InstallState because the queue has a different shape; the two ops are mutually exclusive at runtime.
• InstallService: new ACTION_START_MODULES (+ EXTRA_MODULES) owns the dequeue loop: ModuleName.isAllowed() fail-closed (D2), the sed/echo/runrole command, the AnsibleRunOutcome verdict (non-zero OR error-in-stdout), exit 137 logged as a phantom-kill, revert-on-fail, and finish/fail reporting. Queue is persisted to iiab_queue_prefs as it drains. Cancel routes through the existing ACTION_CANCEL.
• InstallController: processNextInQueue()/installInFlight/revertModuleInLocalVars/ saveQueueToPrefs removed; the launch button now just starts the service (startModuleQueue). verifyInstallationState() reads in-flight state from ModuleQueueRepository, never the half-written local_vars.yml.
• DeployFragment: onResume() no longer re-fires the queue; it observes ModuleQueueRepository (renderModuleQueue) for the launch button + one-shot finish/fail snackbar, and drops installed modules from the selection on DONE. isBatchInstalling() is now derived from the repository (covers a queue started before a recreation), so mutual exclusion holds.
• Supersedes the ADFA-4458/4519 re-entry guard and the installingModuleKeys set (removed from InstallHost + DownloadStateViewModel). The ADFA-4519 showSnackbar() fix is kept and reused.
• Test: AnsibleRunOutcomeTest gains the exit-137 (phantom-kill) case.

Stacks on ADFA-4519 (PR #120); rebases cleanly onto main once that merges.

[luisguzman-adfa]

Validated on device — PR operates correctly and the theme-toggle regression is gone.

With a two-module queue, toggling the theme repeatedly mid-install now keeps a single ./runrole at a time (no more concurrent runs / corruption), the queue keeps advancing across the recreation without pausing, and the module grid shows honest in-progress state (no false "installed"). Reset (#122) and the rootfs install still work. Rebased onto current main and conflicts resolved — mergeable.