Feat/install host side writes

[RonCodes88]

Summary

Moves install file-writing from the daemon to the CLI so the public flow collapses to one line of bun add -g plus one docker run plus agentlock install — no env-var gates, no
per-harness bind mounts. Also fixes a long-standing codex_hooks placement bug that broke codex for users whose ~/.codex/config.toml already had [section] headers.

What changed

• Daemon stops touching the host filesystem. claudeCodePlan, codexPlan, and cursorPlan now take an existing_files map from the request, run the merge logic at plan time, and
  return ops with the final byte-for-byte content. The CLI executes the writes on the host.
• Removed AGENTLOCK_ALLOW_APPLY and AGENTLOCK_ALLOW_APPLY_REAL_HOME. The host-side safety check (checkSafeTarget) lives in the CLI now, where $HOME is real, and is bypassed
  only when --config-dir or AGENTLOCK_DEV_HOME is set.
• Symmetric uninstall. Strip helpers became pure functions; uninstall handlers emit ops with new content for the CLI to write.
• InstallCapabilities shrunk to {unattested_allowed, container}. The CLI's capabilities probe and "container? mount $HOME!" warning are gone.
• New cli/src/util/install-fs.ts — atomic write via tmp+rename, backup_path honored, mid-batch rollback, plus checkSafeTarget and readExistingFiles.
• Bug fix: codexConfigTomlPlan now inserts codex_hooks = true immediately before the first [section] header, with a regression test. The previous append-at-end behavior landed
  the line inside the last section (e.g. [tui.model_availability_nux]) and broke codex with invalid type: boolean true, expected u32.
• Docs converged. cli/README.md, control-plane/README.md, the root README.md, docs/guide/getting-started.md, docs/guide/installation.md, and docs/reference/detection.md
  now show the same three-line public flow and correctly list Cursor as shipped.

Test plan

• bun test (cli), go test -race ./... (control-plane), cargo test (ledger) all pass
• Public flow end-to-end on a clean machine: rebuild image → docker run (no env vars, no host mounts) → bun add -g from local pack → agentlock install → hooks land in
  ~/.claude, ~/.codex, ~/.cursor and reference the global binary
• Existing user keys in ~/.claude/settings.json (model, enabledPlugins, extraKnownMarketplaces) survive install
• Codex regression: install against a config.toml that has [section] headers but no codex_hooks line — line appears before the first [ and codex starts cleanly
• agentlock install --tier totp still produces a TOTP-banner ledger entry