fix: Bugbot findings from promotion PR #397 (TLS floor + delete cache)

[shujaatTracebloc]

Resolves the second round of Cursor Bugbot findings surfaced on the cli promotion PR (#397, develop → main), both introduced/adjacent to the earlier upgrade fix (#402).

Fixes:

• Installer curl omits TLS floor — the shared installerRunScript (used by tracebloc upgrade and tracebloc prepare-host) now downloads the installer with curl -fsSL --tlsv1.2, matching the TLS 1.2 floor scripts/install.sh enforces on every security-sensitive fetch, so this privileged download can never negotiate a weaker protocol. (Release develop → main #397 (comment))
• Nudge recreates wiped config dir — after tracebloc delete wipes ~/.tracebloc, the post-command update check no longer resurrects it. SkipUpdateNudge now also suppresses the nudge (and its cache write) after delete — reusing the existing skip mechanism — and writeUpdateCache no longer MkdirAlls a missing dir (it only writes when the dir already exists), so a throttle cache can never recreate a just-offboarded host data dir. (Release develop → main #397 (comment))

Lands on develop; the promotion PR head picks these up on the next sync and Bugbot re-reviews.

🤖 Generated with Claude Code

---

Note

Low Risk
Targeted CLI hygiene and TLS hardening on installer fetch; behavior change is suppressing update nudge/cache after offboard and skipping cache writes when the data dir is gone.

Overview
Addresses Bugbot findings from the promotion PR around privileged installer downloads and offboard hygiene after tracebloc delete.

Installer download — Shared installerRunScript (used by upgrade and prepare-host) now passes curl --tlsv1.2, aligned with scripts/install.sh, so those downloads cannot negotiate below TLS 1.2. A test locks this in for both subcommand variants.

After offboard — writeUpdateCache no longer MkdirAll the config parent; it only writes when that directory already exists, so a post-command update check cannot resurrect a wiped ~/.tracebloc. SkipUpdateNudge moves from a hard-coded upgrade name check to a Cobra tracebloc.io/skip-update-nudge annotation on upgrade and top-level delete only (not data delete). Tests cover the missing-dir cache behavior and the annotation vs. name collision.

^{Reviewed by Cursor Bugbot for commit db9c2ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5023869. Configure here.}

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- + \u2014 the CLI exercised against a real kind cluster, plus the installer suite\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.