fix(install.ps1): reserve temp paths exclusively instead of adopting them

[DeusData]

Draft on purpose: this file has not been parsed by PowerShell yet. See the last section.

Distilled from #1245 by @ahundt — the two exclusive-reservation helpers and their two call sites, hand-ported onto main's install.ps1. Nothing else from that file is taken: the PR's copy carries an older TLS block that would re-break Windows 10 (#1856), so a wholesale take was never an option.

What was wrong

Two paths were guessable, and one adopted whatever it found:

$TmpDir = Join-Path $env:TEMP "cbm-install-$(Get-Random)"
New-Item -ItemType Directory -Path $TmpDir -Force

Get-Random is seeded per process and its space is small; -Force on an existing directory simply returns it. A directory planted at a guessed name became the staging area — and the owner-only DACL the installer applies is set only afterwards, on a directory someone else created.

$InstallerTmp = "$InstallerDest.new"

A fixed path in the install directory, reservable by anyone who could write there first.

The fix

• Staging directory: GUID name, New-Item -ErrorAction Stop, 32 attempts. A collision is a retry, never an adoption.
• Sibling temp: FileMode.CreateNew + FileShare.None on an unguessable name — an atomic reservation before anything is copied.

One deliberate difference from #1245: the sibling reservation runs inside the existing try, and cleanup checks a path was assigned. That block is documented as best-effort ("a failure here still leaves a working install"), so exhausting 32 attempts should be one more best-effort miss, not a script abort under ErrorActionPreference=Stop.

Verified

• Pure ASCII — PS 5.1 reads a BOM-less .ps1 as ANSI, so a stray non-ASCII byte is a silent breakage.
• LF line endings, matching main.
• Both old call sites gone from live code (the only remaining matches are in the explanatory comment).

Not verified — why this is a draft

No PowerShell has parsed this file. There is no pwsh on the macOS host, the Windows VM is down, and I checked CI: the Windows guards (tests/windows/test_windows_update_handoff.py) verify that update prints the install.ps1 command — they never execute it. So nothing in the pipeline would catch a syntax error here. It needs one [Parser]::ParseFile on a Windows machine before it leaves draft.