Function install 

pub async fn install(
    conn: ConnArgs,
    source_spec: &str,
    sha256: Option<&str>,
    allow_unverified: bool,
    allow_untrusted_host: bool,
    allow_unsigned: bool,
    insecure: bool,
) -> Result<()>

bamboo plugin install <path-or-url> [--sha256 <hex>] [--allow-unverified] [--allow-untrusted-host] [--allow-unsigned] [--insecure] — POST /api/v1/plugins/install. On a 409 (already installed) prints a pointer to bamboo plugin update and returns an error (non-zero exit). A URL source with neither --sha256 nor --allow-unverified gets a 400 from the server (secure by default — see the module docs); a URL from a host outside plugin_trust.trusted_hosts or an unsigned/untrusted-signature bundle gets a 403 (unless the matching opt-out flag, or --insecure, was passed). Every one of those error bodies is already the actionable “pass –X” guidance, surfaced as-is through the branches below.