fix: jq-free one-client guard (2nd Bugbot finding on #284)

[saadqbal]

Resolves the second Cursor Bugbot finding on the client promotion PR (#284, develop → main) — "Namespace reuse needs jq".

The bug

#279's duplicate-release guard (install_client_helm) enumerates client-* releases with helm list -A -o json | jq. The jq-less elif fallback only reads values for the minted TB_NAMESPACE. Post-#838 that's the client slug, not the historical fixed tracebloc namespace — so on a host without jq, an existing release under tracebloc is missed and a second Helm release forks under the slug, double-booking the host (exactly what the guard exists to prevent). jq is not a guaranteed prerequisite: preflight never checks or installs it, and it's used nowhere else in the installer.

Fix

Replace the jq path + single-namespace fallback with one jq-free enumeration across all namespaces — helm list -A + awk on the NAME/NAMESPACE columns, matching client-<ver> in CHART (the same jq-free parse _chart_version already uses). Removes the jq dependency and the fallback divergence that caused the bug.

• scripts/lib/install-client-helm.sh — jq-free helm list -A | awk enumeration.
• scripts/manifest.sha256 — regenerated (the R8 bootstrap verifies each fetched sub-script against it).
• scripts/tests/install-client-helm.bats — the 3 guard tests now mock tabular helm list output (was JSON); new regression test proves the different-namespace reconcile works with jq reported absent (fails on the old fallback, passes here).

shellcheck clean; gen-manifest.sh --check passes; bats green (the lone pre-existing _extract_yaml '' failure is a local macOS bash 3.2 quirk, green in CI, unrelated).

Lands on develop; the promotion PR #284 head picks it up on the next sync and Bugbot re-reviews.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes installer behavior on re-install/upgrade paths where a wrong guard could fork duplicate Helm releases or block legitimate upgrades; scope is limited to enumeration logic in install-client-helm.sh with regression tests.

Overview
Fixes the one-client-per-machine check in install_client_helm so it always discovers existing client-* Helm releases across all namespaces without relying on jq.

The guard no longer uses helm list -A -o json | jq or the jq-less fallback that only read values in the minted TB_NAMESPACE. On hosts without jq, that fallback could miss a release still in tracebloc and install a second release under the client slug. Enumeration is now helm list -A + awk on NAME/NAMESPACE for rows whose CHART matches client-<ver> (same jq-free style as _chart_version).

scripts/manifest.sha256 is updated for the changed installer script. Bats guard tests mock tabular helm list output instead of JSON, and a new test asserts same-client / different-namespace reconcile when has jq is false.

^{Reviewed by Cursor Bugbot for commit cab5e59. Bugbot is set up for automated code reviews on this repo. Configure here.}