publish: carry the Windows product into the projection

The tree adds the installer, service and test paths admitted by this source commit. Nothing else changes about what may cross.

Source-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8

Policy-Sha: 3e4a3aa4ce092e9e3f51bc78daf3ddc14d9638f8

Tree-Digest: 89d6fce3828a0e0de0c8eeb41ee6750f4462217e2a04b5190297134d7f4a50c3

installer/linux/debian/postinst

@@ -30,6 +30,18 @@ case "$1" in
   *) exit 0 ;;
 esac
 
+# Also guard reconfiguration and recovery after an interrupted installation.
+for b in redflag-agent redflag-helper redflag-desktop; do
+    path="$RUN_BIN_DIR/$b"
+    if [ -L "$path" ]; then
+        [ "$(readlink "$path")" = "$PKG_BIN_DIR/$b" ] && continue
+    elif [ ! -e "$path" ]; then
+        continue
+    fi
+    warn "$path is not the package runtime link; explicit migration is required"
+    exit 1
+done
+
 # ---- user, groups -----------------------------------------------------------
 if ! getent group "$LOCAL_GROUP" >/dev/null 2>&1; then
     addgroup --system "$LOCAL_GROUP"
@@ -69,15 +81,15 @@ chown "$AGENT_USER":"$AGENT_USER" "$AGENT_CONFIG_DIR" "$SERVER_KEY_DIR"
 # ---- runtime symlinks -------------------------------------------------------
 # The agent, helper and their sudoers/service contracts all reference
 # /usr/local/bin (agent/internal/constants/paths.go). Debian policy keeps
-# package files out of /usr/local, so ship in /usr/bin and link. A real file at
-# the link path is left alone: that is a helper-performed self-update binary,
-# and clobbering it would silently downgrade the running install.
+# package files out of /usr/local, so ship in /usr/bin and link. The preflight
+# above refuses foreign paths; the package-managed helper refuses self-update.
 for b in redflag-agent redflag-helper redflag-desktop; do
     if [ -L "$RUN_BIN_DIR/$b" ] || [ ! -e "$RUN_BIN_DIR/$b" ]; then
         install -d -m 0755 "$RUN_BIN_DIR"
         ln -sfn "$PKG_BIN_DIR/$b" "$RUN_BIN_DIR/$b"
     else
-        warn "$RUN_BIN_DIR/$b exists and is not a symlink — leaving it (self-updated binary?); packaged build is at $PKG_BIN_DIR/$b"
+        warn "$RUN_BIN_DIR/$b changed during configuration — refusing runtime takeover"
+        exit 1
     fi
 done
 if command -v setcap >/dev/null 2>&1; then
@@ -145,9 +157,11 @@ elif [ -x "$PROVISION" ]; then
     else
         warn "standalone authority provisioning failed — agent installed, local approval unavailable"
         warn "re-run once resolved: sudo REDFLAG_BIN_DIR=$RUN_BIN_DIR $PROVISION"
+        exit 1
     fi
 else
     warn "$PROVISION missing or not executable — standalone authority not provisioned"
+    exit 1
 fi
 
 # ---- desktop access ---------------------------------------------------------
@@ -162,10 +176,12 @@ fi
 
 # ---- service ----------------------------------------------------------------
 if [ -d /run/systemd/system ]; then
-    systemctl daemon-reload || true
-    systemctl enable redflag-agent.service || true
-    systemctl restart redflag-agent.service || \
+    systemctl daemon-reload
+    systemctl enable redflag-agent.service
+    if ! systemctl restart redflag-agent.service; then
         warn "redflag-agent did not start — check: journalctl -u redflag-agent"
+        exit 1
+    fi
 fi
 
 exit 0

installer/linux/debian/postrm

@@ -10,7 +10,7 @@ case "$1" in
   remove|purge)
     for b in redflag-agent redflag-helper redflag-desktop; do
         # Only our own symlinks; a self-updated real binary is left for the operator.
-        if [ -L "$RUN_BIN_DIR/$b" ]; then
+        if [ -L "$RUN_BIN_DIR/$b" ] && [ "$(readlink "$RUN_BIN_DIR/$b")" = "/usr/bin/$b" ]; then
             rm -f "$RUN_BIN_DIR/$b"
         fi
     done

installer/linux/debian/preinst

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Refuse an implicit takeover of script-installed or operator-owned binaries.
+set -e
+case "$1" in install|upgrade) ;; *) exit 0 ;; esac
+for b in redflag-agent redflag-helper redflag-desktop; do
+    path="/usr/local/bin/$b"
+    if [ -L "$path" ]; then
+        [ "$(readlink "$path")" = "/usr/bin/$b" ] && continue
+    elif [ ! -e "$path" ]; then
+        continue
+    fi
+    echo "[ERROR] [deb] [preinst] $path is not this package's runtime link; preserve the existing install and explicitly migrate it before installing redflag" >&2
+    exit 1
+done