e2e: assert install artifact contract and overwrite safety

[codeaholicguy]

Current coverage

Install success cases assert only exit code; the suite does not prove that environment, phase, MCP, and skill artifacts are correct.

What is missing

• Exact files and contents installed from a local config/template/registry
• Valid alternate --config path
• Preserve existing user edits by default
• --overwrite replacement behavior
• MCP merge behavior and malformed existing config
• Partial failure reporting and rerun idempotence

Risk ranking

Medium-high, rank 8: install can silently stop producing promised artifacts while existing E2E remains green.

Recommended E2E tests

• From one local template/registry fixture, assert exact environment, phase, MCP, and skill files plus preserve/--overwrite behavior.

Acceptance criteria

• The checklist tests are merged under e2e/.
• Tests assert artifact contents, not only existence or exit status.
• No remote registry or user HOME is used.

Related audit findings

B5 and A10: package-boundary compatibility and version drift require clean-install validation.