fix(install): drop the sudo ticket on every exit path

[locol23]

Summary

Hardens the sudo keep-alive introduced in #303. Previously the cached sudo ticket was only revoked on the success path (just before the final exec zsh -l), so a fatal git-clone exit or Ctrl-C mid-run left passwordless sudo open until the OS timeout, and the keep-alive loop could linger up to 60s as an orphan.

• Extract sudo_cleanup() (kills the keep-alive loop + sudo -k) and trap it on EXIT
• Trap INT/TERM to exit 130/exit 143 — untrapped fatal signals skip the EXIT trap, and trapping the signal directly to a non-exiting handler would make the script survive Ctrl-C
• Keep sudo_cleanup in the EXIT slot when the ECC / mattpocock-skills tmpdir traps replace it (trap replaces, it does not stack)
• The refresh loop now warns and stops if sudo -n true starts failing mid-run instead of silently looping forever
• Call sudo_cleanup manually before the final exec, which bypasses all traps

Findings from a code-review pass on the original keep-alive (1 HIGH: cleanup unreachable on non-success exit paths; 1 MEDIUM: silent refresh-failure loop).

Test plan

• bash -n install.sh
• Stubbed simulation of the trap/loop structure: on a fatal exit 1, cleanup runs, exit code is preserved, no orphan loop survives
• Real ./install.sh run: one password prompt at start; afterwards sudo -n true prompts again (ticket revoked) and pgrep -f 'sudo -n true' is empty

🤖 Generated with Claude Code