fix(deploy): harden installer reliability and usability

[ZingerLittleBee]

Summary

• make binary and Docker Agent installation transactional, including secure config handling and restoration of an existing Agent after a failed reinstall
• add honest post-install verification for Server health and Agent enrollment, stable exit codes, root-free help/version commands, safer status output, and --no-wait
• make TOML, systemd, OpenRC, and Compose edits atomic, escape special characters, redact sensitive values, validate Compose before restart, and preserve file modes
• expand installer regression coverage, add BusyBox 1.37 compatibility testing in CI, and correct the Agent onboarding path in the Chinese README

Validation

• dash -n deploy/install.sh deploy/test-install-upgrade.sh
• dash deploy/test-install-upgrade.sh (50 installer regression cases)
• shellcheck --shell=dash --severity=warning deploy/install.sh deploy/test-install-upgrade.sh
• docker run --rm -v "$PWD:/work:ro" -w /work busybox:1.37 sh deploy/test-install-upgrade.sh
• cargo clippy --workspace --benches --tests --examples --all-features
• cargo test -p serverbee-agent register (5 passed)
• real VPS matrix: Server Binary, Server Docker, Agent Binary, and Agent Docker, with existing non-target services preserved and restored

Not run because they are outside the installer-focused scope: full cargo test --workspace and the frontend test suite.