feat(installer): activate source builds atomically

README.md

@@ -183,11 +183,18 @@ A Go SSH source installer is implemented as the `source-install` subcommand: it
 detects the remote distro and architecture over the existing SSH transport,
 installs the minimal build prerequisites, downloads and SHA-256-verifies the
 pinned Go 1.26 toolchain, clones/updates the public repository, records the
-resolved branch and commit, and builds the worker to a staging path. It
-deliberately stops before touching the running service or its configuration
-(atomic activation and rollback are the next milestone). The pure
-detection/planning layer and the Docker/OpenSSH test harness that accepts it
-are implemented; see
+resolved branch and commit, builds the worker to a staging path, and then
+atomically activates the staged binary together with the validated environment,
+data directory, and the detected init's service definition. It starts the
+worker and verifies the process and `/healthz`; any activation, start, or
+health failure rolls back to the previous working install (preserving the
+prior binary/env/unit and its enable state), concurrent activations are
+serialized by a lock, a run killed mid-flight is recovered from its
+leftover backup marker on the next activation, and reruns are idempotent
+(exactly one worker process, no leaked temp files). Pass `--no-activate`
+to stop at the staging build, and `--no-start` to install the layout
+without starting the worker. The pure detection/planning layer and the
+Docker/OpenSSH test harness that accepts it are implemented; see
 [`docs/source-installation.md`](docs/source-installation.md); run the live
 fixture matrix with `make test-ssh`.
 
@@ -195,7 +202,8 @@ fixture matrix with `make test-ssh`.
 ./bin/rsmon-worker source-install \
   --host worker.example.com \
   --user deploy \
-  --identity-file ~/.ssh/id_ed25519
+  --identity-file ~/.ssh/id_ed25519 \
+  --token-file ./worker.token
 ```
 
 By default the installer builds the remote's default branch and records what it
@@ -204,13 +212,21 @@ resolves to (the public repository currently publishes `master`). Pass
 install fails before building. The repository must be an `https://` URL without
 userinfo.
 
-The built binary is left at `/opt/rsmon-worker-src/rsmon-worker` (override with
+The built binary is staged at `/opt/rsmon-worker-src/rsmon-worker` (override with
 `--build-dir` / `--stage-binary`), the toolchain at `/usr/local/go` (replaced
 atomically: download, verify, stage, swap with rollback), and the resolved
 branch and commit in `/opt/rsmon-worker-src/rsmon-worker.commit` (written only
-after a successful build). The same SSH auth, secret-file, and host-key options
-as `deploy` apply; no worker token is sent because the source install does not
-configure a service. Prefer `--key-passphrase-file`, `--password-file`, and
+after a successful build). Activation installs the binary to
+`/usr/local/bin/rsmon-worker`, the environment to
+`/etc/rsmon-worker/worker.env` (mode 0600), the data directory to
+`/var/lib/rsmon-worker`, and a systemd unit or OpenRC init script for the
+detected init (an embedded supervisor manages the process when no init is
+running, as in containers). The env and unit are uploaded into a server-side
+0700 `mktemp -d` directory so no local user can race a predictable `/tmp` path,
+and the env file is read/rendered exactly once. The same SSH auth,
+secret-file, and host-key options as `deploy` apply; the worker token is
+supplied with `--token`/`--token-file` and written only to the mode-0600 env
+file. Prefer `--key-passphrase-file`, `--password-file`, and
 `--sudo-password-file` over their direct-flag equivalents: file options keep
 secrets out of the process list and shell history.