refactor: keep root install as the sole installer source

sdk/install-entry.py

@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-"""Generate the standalone Bash entry from the canonical signed installer."""
-
-import argparse
-from pathlib import Path
-import re
-
-
-ROOT = Path(__file__).resolve().parents[1]
-HEADER = '''#!/usr/bin/env bash
-# Generated by sdk/install-entry.py; edit skills/scripts/install.py instead.
-# The complete body must parse before any installation command can execute.
-dever_install() {
-    if [[ ! -x /usr/bin/python3 ]]; then
-        printf '%s\\n' 'Dever 安装需要 /usr/bin/python3 3.9 或更新版本' >&2
-        return 1
-    fi
-    /usr/bin/python3 -I -c 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else "Dever 安装需要 Python 3.9 或更新版本")' || return "$?"
-    local argument help=0
-    for argument in "$@"; do
-        case "$argument" in -h|--help) help=1 ;; esac
-    done
-    local -a command=(/usr/bin/python3 -I -)
-    if (( EUID != 0 && help == 0 )); then
-        if [[ ! -x /usr/bin/sudo ]]; then
-            printf '%s\\n' 'Dever 机器安装需要管理员权限；请安装 sudo 或由管理员执行此脚本' >&2
-            return 1
-        fi
-        command=(/usr/bin/sudo -- "${command[@]}")
-    fi
-    "${command[@]}" "$@" <<'DEVER_INSTALL_PYTHON'
-# Preserve the source entry guard without rewriting the installer program.
-__name__ = "dever_embedded_installer"
-'''
-FOOTER = '''DEVER_INSTALL_PYTHON
-}
-dever_install "$@"
-'''
-
-
-def render(source, public_key):
-    public_key = public_key.strip()
-    if not re.fullmatch(r"[0-9a-f]{64}", public_key):
-        raise ValueError("release.pub must contain one Ed25519 public key")
-    if "DEVER_INSTALL_PYTHON" in source.splitlines():
-        raise ValueError("installer source collides with the shell heredoc delimiter")
-    compile(source, "skills/scripts/install.py", "exec")
-    return HEADER + source + f"\nmain(default_key={public_key!r})\n" + FOOTER
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--check", action="store_true", help="verify the checked-in entry without writing")
-    arguments = parser.parse_args()
-    expected = render((ROOT / "skills/scripts/install.py").read_text(),
-                      (ROOT / "skills/assets/release.pub").read_text())
-    destination = ROOT / "install"
-    if arguments.check:
-        if not destination.is_file() or destination.read_text() != expected:
-            parser.exit(1, "install is stale; run python3 sdk/install-entry.py\n")
-    else:
-        destination.write_text(expected)
-        destination.chmod(0o755)
-
-
-if __name__ == "__main__":
-    main()

sdk/native-release.md

@@ -104,12 +104,12 @@ Only explicit install/update, target add and dependency preparation download off
 
 ## Public installer and static distribution
 
-`python3 sdk/install-entry.py` generates the root `install` from the canonical `skills/scripts/install.py` and the independently provisioned `skills/assets/release.pub`. `--check` verifies that the committed entry is current. The generated Bash contains the complete installer, so `curl -fsSL https://git.dever.cc/shemic/dever/install | bash` does not need a Git checkout or a separate skill download. Keep download, authentication and bootstrap behavior in the Python/Rust owners; do not maintain a second implementation inside the generated file.
+Root `install` is the sole installer source. Maintain its Bash entry and embedded Python directly; there is no generator or separate skill installer. It embeds the independently provisioned public key, so `curl -fsSL https://git.dever.cc/shemic/dever/install | bash` needs neither a Git checkout nor a separate skill download. Keep archive extraction and machine activation in their existing Rust owners. Validate changes with `bash -n install` and the focused `python3 -B -m unittest discover -s test/onboarding -p 'test_install*.py' -v` suite; the tests load the actual root entry instead of copying its implementation.
 
 Configure the web server to serve these anonymous HTTPS paths:
 
 ```text
-/shemic/dever/install                          generated plain Bash script
+/shemic/dever/install                          root install Bash script
 /shemic/dever/dist/latest/dever-<platform>.manifest.json
 /shemic/dever/dist/latest/dever-<platform>.manifest.sig
 /shemic/dever/dist/<version>/dever-<platform>.*  all matching immutable assets