feat(LinuxTentacleE2E): Phase 12.M.L.B.2 — `service install` idempotent re-run E2E

Summary

Pins the contract that re-running sudo squid-tentacle service install on an existing-service host is a non-destructive no-op. Critical for fleet automation + operator self-healing.

Real-world drivers

• Fleet automation (Ansible / Salt) re-runs install playbooks on every reboot for self-healing
• Operator's "have you tried install again" reflex
• Composes with J.M.L.A.4's install-tentacle.sh idempotency: any operator wrapper that runs both .sh + service install must work twice end-to-end

Without this pin, a regression that adds an "already exists, refusing to install" check ships silently and breaks every fleet refresh.

The binary's design IS idempotent today

Per SystemdServiceHost.Install inspection:

• File.WriteAllText overwrites unit file
• systemctl daemon-reload idempotent
• systemctl enable on already-enabled = no-op
• systemctl start on already-running = no-op

This test PINS those properties so a future regression fires CI immediately.

Test mechanism

Install twice in succession with NO cleanup between runs, assert both exit 0 + unit file content byte-identical (same inputs → same regenerated content).

Assertions

Assertion	Pins
Run 1 exit 0	Sanity baseline
Run 2 exit 0	Idempotency contract
Run 2 unit content == Run 1 content	Catches drift in regeneration (Description / ExecArgs / RestartSec)
Run 2 stdout does NOT contain "already exists"	No regression to error-on-existing-state path
Run 2 stdout does NOT contain "Permission denied"	No stale-ownership issue blocking overwrite

Fidelity tier

🟢 High (Rule 12.4): real production binary + real systemd. Composes with J.M.L.B.1's fixture + cleanup pattern.

Expected runtime: ~5-8s.

Test plan

• Linux E2E workflow runs (manual workflow_dispatch after merge)
• B2h_ServiceInstall_IdempotentReRunSucceeds passes within ~10s
• No regression on existing 29 Linux E2E tests

🤖 Generated with Claude Code