Downloads the release for this machine and verifies its checksum (or builds
from source), creates the service user and folders, writes and opens the
environment file, installs the hardened unit and prints the first-run admin
password. Re-running upgrades; --uninstall [--purge] removes it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
