Keep the installation grant out of process arguments

[SaladDay]

What

The self-hosted install command now passes the installation grant in the OAC_INSTALL_GRANT environment variable instead of the last POSIX argument / -Authorization. POSIX commands start with a space so shells that skip history do. --authorization and the bootstrap grant parameters are removed with no alias. The installer reads the variable and unsets it first in parseNativeInstall, so start, the daemon and Harnesses never inherit it. The PowerShell command clears the variable in a finally.

Why

Audit F2: the grant sat in argv for the whole run (readable via /proc, saved in shell history). stdin stays with the interactive prompts, so the environment is the transport.

Verification

• go vet (services/core nativeinstaller+api, apps/daemon ./...): pass
• go test ./internal/nativeinstaller/ (services/core): pass, includes the real generated POSIX command
• go test ./internal/cli -run NativeInstall (apps/daemon): pass; the new test pins that the grant is taken, absent from withNativeEnv, and --authorization is rejected
• python3 scripts/check-names.py: pass
• node --test website/tests/translations.test.mjs: tests 1-2 pass; test 3 needs vitepress, skipped

Skipped

Web typecheck/vitest/e2e (no node_modules; only fixture strings changed), scripts/native-onboarding-smoke.mjs (needs a built bundle), Windows PowerShell tests (no Windows host).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}