refactor: keep root install as the sole installer source

test/onboarding/test_install_entry.py

@@ -1,6 +1,5 @@
 """Standalone Bash contract; subprocesses never install or change services."""
 
-import importlib.util
 import json
 import os
 from pathlib import Path
@@ -8,11 +7,10 @@ import subprocess
 import tempfile
 import unittest
 
+from install_support import entry_with_python, load_installer
+
 
 ROOT = Path(__file__).resolve().parents[2]
-spec = importlib.util.spec_from_file_location("dever_install_entry", ROOT / "sdk/install-entry.py")
-generator = importlib.util.module_from_spec(spec)
-spec.loader.exec_module(generator)
 
 
 class InstallEntryTests(unittest.TestCase):
@@ -20,10 +18,10 @@ class InstallEntryTests(unittest.TestCase):
         return subprocess.run(["/bin/bash", "-s", "--", *arguments], input=script,
                               env={}, text=True, capture_output=True, timeout=10, **kwargs)
 
-    def test_generated_entry_matches_source_and_independent_key(self):
-        expected = generator.render((ROOT / "skills/scripts/install.py").read_text(),
-                                    (ROOT / "skills/assets/release.pub").read_text())
-        self.assertEqual((ROOT / "install").read_text(), expected)
+    def test_root_entry_pins_the_independent_key_and_has_valid_shell_syntax(self):
+        installer = load_installer()
+        self.assertEqual(installer.DEFAULT_PUBLIC_KEY,
+                         (ROOT / "skills/assets/release.pub").read_text().strip())
         syntax = subprocess.run(["/bin/bash", "-n", str(ROOT / "install")], env={},
                                 text=True, capture_output=True, timeout=10)
         self.assertEqual(syntax.returncode, 0, syntax.stderr)
@@ -45,19 +43,17 @@ class InstallEntryTests(unittest.TestCase):
     def test_arguments_python_isolation_and_exit_code_are_preserved(self):
         source = '''import json
 import sys
-def main(default_key):
-    print(json.dumps([sys.argv[1:], default_key, sys.flags.isolated]))
-    raise SystemExit(37)
+print(json.dumps([sys.argv[1:], sys.flags.isolated]))
+raise SystemExit(37)
 '''
-        key = "ab" * 32
-        script = generator.render(source, key)
+        script = entry_with_python(source)
         arguments = ["--release", "/a path/with 'quotes'", "", "$(not executed)", "*", "--no-start"]
         result = self.run_bash(script, *arguments)
         self.assertEqual(result.returncode, 37, result.stderr)
-        self.assertEqual(json.loads(result.stdout), [arguments, key, 1])
+        self.assertEqual(json.loads(result.stdout), [arguments, 1])
 
     def test_truncated_body_does_not_execute_python_or_sudo(self):
-        script = generator.render('def main(default_key):\n    print("EXECUTED")\n', "ab" * 32)
+        script = entry_with_python('print("EXECUTED")\n')
         for end in (script.index("import sys"), script.index("DEVER_INSTALL_PYTHON\n}"),
                     script.index('\ndever_install "$@"')):
             result = self.run_bash(script[:end])