Module control_plane_install 

Shared install-script builder for a control-plane (yubaba + kamaji) roll.

This is the ONE net-new mechanism of the rolling-upgrade envelope (R608): the atomic fetch→verify→install→restart of the signed yubaba+kamaji pair. It lives here — in the crate BOTH the CLI orchestrator and yubaba itself depend on — so the two apply transports share a single, trusted script and cannot drift:

• SSH transport (R608-F5, app/yah/cli/src/rollout/apply.rs::apply_over_ssh) pipes the script to ssh <node> bash -s from the orchestrator.
• Mesh transport (R608-F10, yubaba POST /self-update) runs the same script locally on the node via a systemd-run transient unit — no SSH.

The script is a state-preserving, atomic transcription of the install tail of stand-up-yubaba.sh: fetch the signed release tarball, sha256 -c it against the digest the signed manifest already resolved (callers only ever pass manifest-derived values — there is no path for an AI or a wire request to fabricate a version/url/digest), extract, stage each file next to its target on the same filesystem, then mv it into place so a half-written /usr/local/bin/yubaba can never appear. yubaba + kamaji install as one atomic pair (W275 OQ5).

Never touches durable state. The script contains no reference to /var/lib/yah-cloud/identity.json (the ed25519 host identity — wiping it forces a re-TOFU and breaks hostkey-drift detection, the R589 gotcha) or the raft log dir. A roll moves /usr/local/bin bytes + unit files, nothing else. The [tests::script_never_touches_durable_state] test is the guard.

Functions

build_install_script

Build the self-contained install script for the yubaba+kamaji pair.