Harden the shared installCmd bootstrap idiom to fail closed on download error

[shujaatTracebloc]

Context

Spun out of Bugbot's review on #394 (thread on prepare_host.go).

installCmd (internal/cli/doctor.go) is bash <(curl -fsSL https://tracebloc.io/i.sh). Process substitution does not propagate curl's exit code — if curl fails (network/DNS/HTTP), bash reads an empty script from the substituted fd and exits 0. So any recovery/reinstall hint built from installCmd (doctor reinstall hints, "set one up" hints, and the prepare-host failure hint) can report success without actually running anything — and can even execute a partially-downloaded script.

This is a CLI-wide property of the shared bootstrap idiom, not specific to prepare-host. #394's automated path is already fail-closed (it downloads to a temp file with set -e + curl -o and checks curl's exit before running). Only the copy-paste manual hints inherit the fail-open behavior.

Task

Harden the shared bootstrap idiom so the printed one-liners fail closed too, without losing interactive-stdin (the reason bash <(curl …) was chosen). Options to weigh:

• Download-to-temp-file + set -e (fully fail-closed, avoids partial-execution) — but multi-line.
• bash <(curl -fsSL URL || echo 'exit 1') — one-line, fails closed on curl error, but can still run a partial download on mid-stream failure.

Whatever we pick, update the doctor copy-catalog goldens and keep every hint deriving from one source.

Affected

• internal/cli/doctor.go (installCmd, and its use in reinstall/"set one up" remedies)
• internal/cli/prepare_host.go (prepareHostManualHint)
• copy-catalog goldens (05-doctor, zz-all-strings)