Replace stale bin/install.sh with a wrapper over sync.py restore

bin/install.sh still rsynced --delete from a backup path retired in July, so
the documented Linux install both failed and could erase a working tree. Every
step it claimed to do already lives in bin/sync.py, shared with Windows.

Root ./install.sh is now a thin wrapper over `sync.py restore`, so deployment
stays one bash command. It also registers ncp/promethean in ~/.bashrc, which
was the only thing the old script uniquely did.

Split restore-linux.sh into runtime (Ollama binary, shell aliases) and desktop
(XFCE panel, theme, os-release). Only desktop writes outside the repo, it now
auto-skips off XFCE, and `--no-desktop` skips it explicitly. Two tests keep the
stage names in sync and the $HOME writes confined to the desktop stage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_smoke.py

@@ -209,3 +209,29 @@ def test_sync_compare_detects_direction(tmp_path):
 
     db.unlink()
     assert sync.compare(db, dump) == "no-live"
+
+
+def test_restore_stages_match_the_script():
+    """sync.py invokes restore-linux.sh stages by name with check=False, so a
+    rename on one side alone fails silently - and the runtime stage is what
+    installs Ollama and the ncp alias. Keep the two in agreement."""
+    import re
+    called = set(re.findall(
+        r'linux_stage\(\s*"restore-linux\.sh"\s*,\s*"(\w+)"',
+        (REPO_ROOT / "bin" / "sync.py").read_text()))
+    script = (REPO_ROOT / "bin" / "restore-linux.sh").read_text()
+    handled = set(re.search(r"case \"\$stage\" in\s*\n\s*([\w|]+)\)", script).group(1).split("|"))
+    assert called, "no restore-linux.sh stages found in sync.py"
+    assert called <= handled, f"sync.py calls unhandled stage(s): {called - handled}"
+
+
+def test_desktop_stage_is_the_only_one_touching_home():
+    """--no-desktop is only a real safety valve if the $HOME writes all live in
+    the desktop stage. A test clone runs prep + runtime unconditionally."""
+    script = (REPO_ROOT / "bin" / "restore-linux.sh").read_text()
+    runtime = script.split('if [ "$stage" = "runtime" ]; then')[1].split("\n    exit 0\nfi")[0]
+    # The ncp/promethean shell aliases are the one deliberate exception - they're
+    # how you launch NexusOS at all, and both are grep-guarded no-ops on re-run.
+    home_writes = [ln for ln in runtime.splitlines()
+                   if "$HOME" in ln and ".bashrc" not in ln]
+    assert not home_writes, f"runtime stage writes to $HOME: {home_writes}"