feat(installer): self-elevate an un-elevated PowerShell run + cmd-safe docs (#421)

[shujaatTracebloc]

What & why

Real users paste the one-liner into a normal PowerShell (or cmd.exe), where the install either dies later on the admin requirement or fails syntactically. #386 added elevation instructions; this automates the common case so a hospital user doesn't need to know "Terminal (Admin)" is a separate thing.

Changes (scripts/install-k8s.ps1, docs/INSTALL.md)

• Self-elevate: on an un-elevated interactive run, offer to relaunch elevated — one consent → Start-Process -Verb RunAs (one UAC prompt) → install proceeds. Get-ElevationCommand builds the relaunch args: re-run the on-disk .ps1 when present, else re-fetch the documented one-liner (irm … | iex), forwarding -NoReboot / -Diagnose.
• Graceful fallback: non-interactive, declined, or a failed launch → the followable Win+X → Terminal (Admin) steps (Installer (Windows): admin-gate says "right-click > Run as Administrator" — impossible to follow in the irm|iex flow #386 behavior preserved).
• cmd-safe docs: docs/INSTALL.md now shows the Command-Prompt form powershell -ExecutionPolicy Bypass -Command "irm … | iex" so a paste into cmd.exe runs instead of erroring, plus the exact Win11 admin steps.

Acceptance (from #421)

• Detect un-elevated PowerShell → offer to relaunch elevated (RunAs), one-line consent, forwarding switches
• Document a cmd-safe variant on the install snippet
• docs/INSTALL.md aligned with exact Win11 steps (Win+X → Terminal (Admin))
• Paste into un-elevated PowerShell → one UAC consent → install proceeds; paste into cmd → working guidance

Scope notes

• Env-var config (TRACEBLOC_*) is intentionally not forwarded across RunAs: ShellExecute doesn't inherit the caller's process env, and putting secrets on a command line is unsafe. Documented — env-driven runs should be launched elevated.
• The website install snippet + screenshot live in tracebloc-website (separate repo), so they're out of scope here; the cmd-safe form is captured in docs/INSTALL.md.

Tests

Get-ElevationCommand (on-disk -File vs one-liner re-fetch, switch forwarding) + gate source guards (offers RunAs before instructions; only prompts when interactive).

Local verification

Pester 294/0/9 · check-style pass · drift clean · manifest regenerated · PS parse OK. (No bash changes — bats unaffected.)

Closes #421

---

Note

Low Risk
Installer UX and documentation only; elevation logic is gated on interactivity with tested fallbacks and does not change cluster or credential handling.

Overview
Windows installer no longer exits immediately when run without Administrator rights. In an interactive session it warns, asks to relaunch elevated, and uses Start-Process -Verb RunAs (one UAC prompt). Get-ElevationCommand / Invoke-SelfElevate build the relaunch: durable on-disk .ps1 paths use quoted -File and forward -NoReboot / -Diagnose; the documented irm | iex path and bootstrap temp scripts re-fetch the one-liner (switches not forwarded to the paramless shim). Declined, non-interactive, or failed elevation still shows the Win+X → Terminal (Admin) steps from #386.

docs/INSTALL.md splits PowerShell vs Command Prompt install lines, adds the powershell -ExecutionPolicy Bypass -Command "irm … | iex" form for cmd.exe, and documents admin requirements plus optional self-elevation.

Tests cover Get-ElevationCommand quoting and paths; manifest hash updated for install-k8s.ps1.

^{Reviewed by Cursor Bugbot for commit 09eb02a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 31 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc  #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI) #221) · author: @divyasinghds · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1352 — fix(reaper): route phantom-reaper logs to App Insights (backend#1132) · author: @saqlainsyed007 · no reviewer assigned
• claude-skills#14 — feat(skill): add tracebloc-frontend-app skill · author: @waqaskhanroghani · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 07f6df3. Configure here.}