refactor: keep root install as the sole installer source

install

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Generated by sdk/install-entry.py; edit skills/scripts/install.py instead.
+# Canonical installation source; the embedded Python shares this entry's lifecycle.
 # The complete body must parse before any installation command can execute.
 dever_install() {
     if [[ ! -x /usr/bin/python3 ]]; then
@@ -20,9 +20,6 @@ dever_install() {
         command=(/usr/bin/sudo -- "${command[@]}")
     fi
     "${command[@]}" "$@" <<'DEVER_INSTALL_PYTHON'
-# Preserve the source entry guard without rewriting the installer program.
-__name__ = "dever_embedded_installer"
-#!/usr/bin/env python3
 """Install an authenticated Dever release; no application configuration is read."""
 
 import argparse
@@ -43,6 +40,7 @@ RELEASES = "https://git.dever.cc/shemic/dever/dist"
 MAX_METADATA = 2 * 1024 * 1024
 MAX_RELEASE = 2 * 1024 * 1024 * 1024
 ASSET_HOSTS = {"git.dever.cc"}
+DEFAULT_PUBLIC_KEY = "7889e0edaf5fbf1060bef4ad6e27106128485c8412a6f6cd4457dc67e112986e"
 
 
 class OfficialRedirect(urllib.request.HTTPRedirectHandler):
@@ -232,9 +230,9 @@ def download_archive(address, destination):
             output.write(contents)
 
 
-def install(arguments, default_key=None):
+def install(arguments):
     if os.geteuid() != 0:
-        raise ValueError("机器安装需要管理员权限；先检查脚本，再用 sudo python3 执行")
+        raise ValueError("机器安装需要管理员权限；请通过根 install 入口执行")
     platform = platform_name()
     prerequisites(platform)
     if arguments.version != "latest" and not re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", arguments.version):
@@ -254,7 +252,7 @@ def install(arguments, default_key=None):
         key_path = arguments.trusted_key
         if key_path is None:
             key_path = scratch / "independent-release.pub"
-            key_path.write_text(default_key)
+            key_path.write_text(DEFAULT_PUBLIC_KEY)
         version, catalog, key = authenticate(release, key_path, scratch, platform, arguments.version)
         trusted = scratch / "release.pub"
         trusted.write_text(key.hex() + "\n")
@@ -271,17 +269,16 @@ def install(arguments, default_key=None):
     print(f"Dever {version} 已安装到 {system_root / 'opt/dever'}")
 
 
-def main(default_key=None):
+def main():
     parser = argparse.ArgumentParser(prog="dever install", description=__doc__)
     parser.add_argument("--version", default="latest")
     parser.add_argument("--release", type=Path, help="使用本地已签名发行目录，不下载")
-    key_path = None if default_key is not None else Path(__file__).resolve().parents[1] / "assets/release.pub"
-    parser.add_argument("--trusted-key", type=Path, default=key_path)
+    parser.add_argument("--trusted-key", type=Path)
     parser.add_argument("--system-root", type=Path, default=Path("/"), help="已有的自有安装镜像目录；默认安装当前机器")
     parser.add_argument("--no-start", action="store_true", help="不启动当前机器 systemd 服务")
     arguments = parser.parse_args()
     try:
-        install(arguments, default_key)
+        install(arguments)
     except (OSError, ValueError, KeyError, TypeError, subprocess.SubprocessError) as error:
         parser.exit(1, f"Dever 安装失败：{error}\n")
 
@@ -289,7 +286,6 @@ def main(default_key=None):
 if __name__ == "__main__":
     main()
 
-main(default_key='7889e0edaf5fbf1060bef4ad6e27106128485c8412a6f6cd4457dc67e112986e')
 DEVER_INSTALL_PYTHON
 }
 dever_install "$@"