Function build_install_script 

pub fn build_install_script(
    version: &str,
    url: &str,
    sha256: &str,
    sudo: bool,
) -> String

Build the self-contained install script for the yubaba+kamaji pair.

sudo is true when the executing user is not root (e.g. an SSH login as debian@…), matching stand-up-yubaba.sh’s SUDO convention. The mesh (self-update) path runs the script as root inside a systemd-run transient unit, so it passes sudo = false. The script is idempotent and atomic; it anchors what it is about to replace, restarts kamaji then yubaba (W154 supervision order) and echoes the installed versions so the caller can log them — after having already proved the install by hash, not by those strings.

version/url/sha256 MUST come from a signed release manifest — this builder does no verification of its own beyond emitting the sha256sum -c check; integrity rests on the caller only ever passing manifest-resolved values.