Behavioral coverage for install.sh's clone_repo() guard (removes a commit-less checkout, keeps a real one, ignores a non-repo dir) plus a contract check that install.ps1's repo-validity gate requires a resolvable HEAD.
