Small fixes in the installer, the recovery tool, the hooks and CI's checks

[DevomB]

Small fixes from the repository cleanup's bug list, each checked against main 91c3238.

• kryptik-install checks veritysetup and the coreutils it calls (cut basename mv mountpoint rmdir chmod rm cat sleep) before the first write. Without veritysetup an install failed after partitioning and writing slot A, with a misleading "does not verify".
• kryptik-recover: a --restore-slot that died between mounting the medium and finishing left /run/kryptik-recover-media and the loop-mounted ESP image mounted; the exit trap now unmounts all three (the ESP image first, since it lives on the medium). It also checks root.json's total_bytes, sha256 and version for form, as the installer does, so an empty field no longer reads as "slot is smaller than the medium's root image".
• check-pin-reviews.sh: --survey or --reviews given last made shift 2 fail without shifting, and the loop never ended. Both now need their value (${2:?...}), as the other tools' options do.
• artifact-manifest.sh: emit_tree set a RETURN trap twice, so the second replaced the first (two temporary files leaked) and the trap stayed set after the function, firing on every later return. One trap now removes all four files and then itself.
• The pre-commit hook and CI's "No CRLF in scripts" found scripts only by extension, so tools/kryptik, kryptik-update, kryptik-recover, kryptik-session, kryptik-chrome, the hooks and the s6 run files were never checked. Both now take a file whose first line is a shebang too; the hook's bash -n takes shell shebangs.
• source-notes.tsv: the bc row described the fix-libmath_h shim that 72ab0b0 removed, so the inventory reported a caveat that no longer exists.
• install-test.sh: a blkid inside the label capture whose output nothing read. 05-kernel.sh: the RAM-capped kryptik_default_jobs like every other stage (top-level code, so nothing rebuilds; the same 4 jobs on a runner).
• decisions.md: ADR-011's last sentence said the cookies help "a machine whose firmware has no SMT to turn off"; they help when SMT is on all the same, since plain nosmt lets root turn it back on. ADR-012 said the root image is 2.7 GB; v0.1.0's root.json gives 1.66 GB with its hash tree.

Left out: wlprobe.c trusts the string lengths in the compositor's messages (it is a test tool talking to a trusted compositor, and #191 and #201 both rewrite it).

Conflicts to expect, all small: #176 (ci.yml), #199 (check-pin-reviews.sh, pre-commit, source-notes.tsv), #203 (kryptik-recover, artifact-manifest.sh), #206 and #210 (05-kernel.sh comments), #179 #180 #188 #207 (the installer, elsewhere in the file), the design PRs (decisions.md, at its end only).

The installer and kryptik-recover are on the medium, so this needs one Distro run.