fix: correct harness defects found running the matrix

First full run on the KVM host surfaced three harness bugs and two stale
image URLs; all fixed here.

Harness bugs:
- Liveness probe used `bot-bottle --version`, which the CLI does not implement
  (unknown args die non-zero) — so every SUCCESSFUL install was misreported as
  "no runnable entry point". Switched to `bot-bottle --help`, which exits 0
  before any DB/migration/network work.
- cmd_down never removed serial.log, so its rmdir failed and every run left an
  orphan scratch dir behind. Added serial.log to the cleanup.
- The teardown trap was armed AFTER cmd_up, but cmd_up's wait_for_ssh can fail
  with QEMU already running (a guest that never opens SSH) — leaking the VM.
  Arm the trap before cmd_up.

Stale image URLs:
- Fedora 41 is EOL and 404s; bumped to Fedora 44 (44-1.7).
- Alpine bumped to 3.21.7; its cloud images ship a .sha512 only (this verifier
  is sha256), so SUM_URL is now empty (skip) with a note.

Validated on delphi (QEMU 11.0.2): ubuntu/fedora/arch pass BOTH test and
test-ready. Alpine (cloud-init seed not applied → no SSH) and NixOS (no
upstream cloud qcow2) remain blocked on image provisioning, documented in the
research note as follow-ups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/research/testing-clean-install-on-linux.md

@@ -84,6 +84,40 @@ Each distro exercises a different corner of the installer:
 | **Alpine** | Alpine "cloud" (cloudinit) image | musl libc + BusyBox `sh` — the harshest POSIX-`sh` host for a `#!/bin/sh` installer. |
 | **NixOS** | `channels.nixos.org` OpenStack image | No FHS `~/.local` on PATH by default; `nix-env` user-profile prereqs; pipx laying a self-contained venv on a non-FHS host. |
 
+### Validation run (2026-07-27)
+
+First full run on the delphi KVM host, QEMU 11.0.2:
+
+| Distro | `test` (bare) | `test-ready` (prepared) |
+|---|---|---|
+| Ubuntu 24.04 | ✅ declines at git gate | ✅ installs, doctor python+config green |
+| Fedora 44 | ✅ declines at git gate | ✅ installs, doctor python+config green |
+| Arch (latest) | ✅ declines at git gate | ✅ installs, doctor python+config green |
+| Alpine 3.21 | ⚠️ blocked (boot) | ⚠️ blocked (boot) |
+| NixOS 24.11 | ⚠️ blocked (no image) | ⚠️ blocked (no image) |
+
+On all three working distros the bare `test` sees `install.sh` exit 1 at the
+git-for-git-specs gate (cloud images ship python3 but not git) — a sound
+decline — and `test-ready` installs cleanly with `doctor` reporting a usable
+python and config (backends all not-ready, as expected in a plain VM).
+
+**Two known gaps, both in image provisioning rather than the installer:**
+
+- **Alpine** boots to a `localhost login:` prompt but its cloud image does not
+  apply our NoCloud (`cloud-localds`) seed the way Ubuntu/Fedora/Arch do, so
+  the SSH key is never injected and `wait_for_ssh` times out. Needs an
+  Alpine-specific seed path (e.g. presenting the seed as a CD-ROM, or Alpine's
+  `tiny-cloud` expectations) before it can run.
+- **NixOS** publishes no downloadable cloud qcow2 on `channels.nixos.org` or
+  the release bucket (its cloud images are Hydra-built AMIs). The table URL
+  404s; a working NixOS cell needs a locally built image (`nixos-generators`,
+  baking the test key), which is a follow-up.
+
+The run also fixed real defects it surfaced: the pinned Fedora 41 was EOL/404
+(bumped to 44), and the liveness probe used `bot-bottle --version` — which the
+CLI does not implement, so every successful install was misreported as failed
+until it was switched to `bot-bottle --help`.
+
 In `test-ready` the harness installs `python3 + git + pipx` first on each
 distro (install.sh installs none of them), so all five drive the recommended
 pipx path. `test` then removes that scaffolding and lets each distro's bare