feat(installer,web): one canonical bundle per target; robust in-place upgrades; update-check feedback (#142)

Co-authored-by: Yaowei Zheng <hiyouga@buaa.edu.cn>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

packages/landing/public/install.sh

@@ -12,10 +12,13 @@ set -eu
 # Download to a file first, then run it: piping straight into `sh` would execute
 # a truncated download line by line, and the real installer removes the old
 # bin/lib/web/node before moving the new ones in — a cut connection mid-way
-# would leave no install at all.
-TMP="$(mktemp)"
-trap 'rm -f "$TMP"' EXIT
-curl -fsSL "https://github.com/Prism-Shadow/penguin-harness/releases/latest/download/install.sh" -o "$TMP"
+# would leave no install at all. The file lives in a private mktemp -d (0700)
+# directory: the real installer picks up a payload sitting next to a script
+# named install.sh (the extracted-bundle offline path), and a shared /tmp must
+# never offer that seam to other local users.
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+curl -fsSL "https://github.com/Prism-Shadow/penguin-harness/releases/latest/download/install.sh" -o "$TMP_DIR/install.sh"
 rc=0
-sh "$TMP" "$@" || rc=$?
+sh "$TMP_DIR/install.sh" "$@" || rc=$?
 exit "$rc"