Replace stale bin/install.sh with a wrapper over sync.py restore

bin/install.sh still rsynced --delete from a backup path retired in July, so
the documented Linux install both failed and could erase a working tree. Every
step it claimed to do already lives in bin/sync.py, shared with Windows.

Root ./install.sh is now a thin wrapper over `sync.py restore`, so deployment
stays one bash command. It also registers ncp/promethean in ~/.bashrc, which
was the only thing the old script uniquely did.

Split restore-linux.sh into runtime (Ollama binary, shell aliases) and desktop
(XFCE panel, theme, os-release). Only desktop writes outside the repo, it now
auto-skips off XFCE, and `--no-desktop` skips it explicitly. Two tests keep the
stage names in sync and the $HOME writes confined to the desktop stage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bin/sync.py

@@ -237,7 +237,9 @@ def cmd_restore(args) -> int:
         return 1
     restore_db()
     rebuild_env()
-    linux_stage("restore-linux.sh", "desktop")
+    linux_stage("restore-linux.sh", "runtime")
+    if not args.no_desktop:
+        linux_stage("restore-linux.sh", "desktop")
     print("\nRestore complete. Nexus is ready to start.")
     print("Note: Ollama models are not in the backup - pull them with `ollama pull <model>`.")
     return 0
@@ -323,6 +325,9 @@ def main() -> int:
 
     restore = sub.add_parser("restore", help="pull from Gitea, rebuild DB + venv + web UI")
     restore.add_argument("-c", "--check", action="store_true", help="dry run, change nothing")
+    restore.add_argument("--no-desktop", action="store_true",
+                         help="skip the XFCE desktop wiring (panel, theme, os-release). "
+                              "Use for a test clone - that stage writes to $HOME, not the repo.")
     restore.set_defaults(func=cmd_restore)
 
     backup = sub.add_parser("backup", help="dump DB, commit and push to Gitea")