fix(installer): harden HVE Core installer scripts

[katriendg]

Intention

Strengthen the HVE Core installer scripts against accidental secret or metadata copying, unsafe CLI execution, interrupted manifest writes, unusual filenames, and unverified local source clones.

Preserve existing path-containment protections and Bash/PowerShell parity.

Acceptance Criteria

• Skill copying excludes .git, .env variants, .DS_Store, and Thumbs.db.
• Bash skill copying safely handles filenames containing newlines.
• Extension validation accepts only code and code-insiders.
• PowerShell ejection replaces its manifest through a same-directory temporary file and cleans up after failures.
• Failed manifest writes or replacements leave the original manifest unchanged.
• Mounted and Multi-Root installations warn when the source clone has a missing or unexpected origin.
• Users can explicitly continue with an intentional fork or local clone.
• Existing path-containment, manifest-schema, symlink, and cross-shell parity tests continue to pass.
• Focused tests and script, skill, and documentation validation pass.

Non-Goals

• Duplicating the existing target-root containment checks.
• Blocking legitimate forks or local development clones.
• Adding dependencies or new installer entry points.