fix: close the four known installer bugs (DU-H1, DU-H2, BUG-1, BUG-2)

- DU-H1: flags are parsed wherever they sit, so `install --unattended`
  and `--unattended install` are the same run; any unknown flag, word,
  or subcommand exits 2 to stderr before a package manager is touched.
- DU-H2: every download lands in one private mktemp -d (mode 700)
  workdir per run, is checked non-empty before sudo tar sees it, and an
  EXIT/INT/TERM trap cleans up. No fixed /tmp paths remain.
- BUG-1: ^t is now toggle-shown — it ticks only the rows the active
  filter is showing, and @needs expansion stops at the first invasive
  row, so an invasive package can never be ticked off-screen.
- BUG-2: ^t journals what it added, so a second ^t over the same shown
  set unticks exactly that set; the bind no longer clears the query.
- lab: the type verb polls fzf's reported query to a deadline instead
  of a fixed sleep; marks_settled retries within its deadline.

Suite 256/0 host, 214/0 docker (ubuntu:24.04), mutations 24/24 killed
(six new mutants re-introduce each bug and all die), lab 6/6 green.

README.md

@@ -120,8 +120,11 @@ safer than something inside it.
 ticking `xrdp` ticks the `desktop` group it is useless without, and unticking
 `core/node` drops `codex`, `pi`, `pi-plugins`, `mermaid-cli` and then `neovim`
 — six rows including `node` itself. The closure is shown, not described: the
-counts move on the same keystroke, and `^t` clears the filter so the rows it
-just pulled in are on screen rather than hidden behind your query.
+counts move on the same keystroke. `^t` is the one place the closure is
+clipped: it follows `@needs` only as far as the first `invasive` row, so a bulk
+toggle over a filter can never tick a root-equivalent daemon you were not
+looking at — filter for `nvidia` and the docker group stays off. Press `^t`
+again over the same rows and it hands back exactly what it took.
 
 `^o` is a toggle, not "open all": press it again and everything closes. And on
 the default collapsed screen every group row counts as "shown", so a single