ci: harden golden-path installer CI guards

[dmoliveira]

Summary

• add installer-ci-flags-check and wire it through Makefile, smoke checks, and ci-quick guard coverage
• make golden-path CI invocation explicit with INSTALLER_SKIP_UPGRADE=1 INSTALLER_SKIP_BR=1
• make tmux plugin bootstrap non-fatal for headless CI and scope golden-path concurrency cancellation per ref

Validation

• make installer-ci-flags-check
• make golden-path-guards-check
• make smoke-guards-check
• make ci-quick

Notes

• supersedes ci: enforce installer CI skip-upgrade flag guards #118 (rebased replacement because non-fast-forward force push is blocked in this environment)