fix(installer): harden provision location + client-detect guards (#309 bugbot)

[divyasinghds]

Summary

Addresses two of the three Cursor Bugbot findings on the #309 (develop→main) promotion PR. The third is a false positive and is intentionally left unchanged (see below).

Related

Ref #309

Type of change

• Bug fix

Findings fixed

1. Whitespace bypasses location requirement (medium). In the no-timezone-detection path, client_location was checked with [[ -n ]] before trimming, so a whitespace-only answer broke the retry loop, skipped the "location is required" error, and fell through to a client create with no --location. Now trimmed inside both prompt loops before the non-empty checks — scripts/lib/provision.sh.
2. mktemp failure skips client guard (medium). detect_installed_client did mktemp || return 0, treating an environment error as "no client installed" and silently skipping the Helm one-client guard and the Installer mints a new client before the one-client-per-machine guard — orphans it on the backend #303 ownership check. Now falls back to a dir we own (same pattern as the client create step) and only gives up when there's genuinely nowhere to write — scripts/lib/install-client-helm.sh.

Finding intentionally NOT changed (false positive)

Bugbot's "Wrong CLI command in summary" claimed tracebloc data ingest ./data should be tracebloc dataset push. This is backwards. Per tracebloc/cli internal/cli/data.go:

• command group data is canonical; dataset is a deprecated alias ("kept for one deprecation cycle")
• subcommand ingest <local-path> is canonical; push is a deprecated alias

So the installer's tracebloc data ingest ./data is the correct, current command. (e2e-journey.sh and the README happen to use the dataset push alias — still valid during the deprecation window, but not the canonical form.) Left as-is.

Test plan

• bash -n on changed shell scripts — clean.
• scripts/gen-manifest.sh --check — up to date (manifest regenerated for the two changed scripts).
• Existing bats tests unaffected: location tests use env-var / non-interactive paths that bypass the prompt loops; detect_installed_client is stubbed in provision.bats.

Deployment notes

None.

---

Note

Medium Risk
Changes affect provisioning and one-client safety checks on install; logic is narrow but mistakes could allow wrong client pairing or weak location validation.

Overview
Client detection — detect_installed_client no longer treats a failed mktemp as “no client installed” (which could skip the Helm one-client guard and the #303 ownership pre-flight). It now falls back to a temp file under HOST_DATA_DIR (same pattern as client create output capture) and only returns empty when there is nowhere to write.

Location prompts — During interactive provisioning, client_location is trimmed before [[ -n ]] checks in both the timezone-detected path and the manual retry loop, so whitespace-only input is treated as blank (Enter to accept detected zone, or keep retrying until a real zone is entered).

^{Reviewed by Cursor Bugbot for commit d852c2e. Bugbot is set up for automated code reviews on this repo. Configure here.}