Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

From review: the store and broker passwords genesis makes were carried into
the controller through a world-readable file in /tmp, a bundle left at 0644 by
an earlier installer kept that mode while now holding them, a mesh raised by
the old installer would have been handed new passwords its servers do not have,
and the broker-admin action's marker did not depend on the value. Secrets now
stage in a 0700 directory owned by the controller's account; the bundle is
chmod'd; an existing store or broker volume with no credential file is refused
by name; the marker holds the password's fingerprint. Also: one install path
for the store, broker and vault, no error-string matching for the operator
key, and no unreachable fallback for the superuser.

internal/bootstrap/bootstrap.go

@@ -394,6 +394,9 @@ func Run(ctx context.Context, o Options, d Deps, say func(string)) (Result, erro
 	if err != nil {
 		return result, failed(StepBundle, err)
 	}
+	if err := RefuseExistingServers(ctx, d.Run, creds); err != nil {
+		return result, failed(StepBundle, err)
+	}
 	root, err := RewriteRoot(&rewritten, creds)
 	if err != nil {
 		return result, failed(StepBundle, err)
@@ -644,13 +647,13 @@ func Run(ctx context.Context, o Options, d Deps, say func(string)) (Result, erro
 		return result, failed(StepStore, err)
 	}
 
-	// ---- 14b. broker ----------------------------------------------------------------------
+	// ---- broker ---------------------------------------------------------------------------
 	say("broker — the foundation's broker, adopted as the lavinmq module: one bus, not two")
 	if err := InstallBroker(ctx, o, permanentControl, rewritten.Declaration, say); err != nil {
 		return result, failed(StepBroker, err)
 	}
 
-	// ---- 14c. vault -----------------------------------------------------------------------
+	// ---- vault ----------------------------------------------------------------------------
 	// A foundation module (novox/hq ADR 0085, amended): it keeps every operator-sealed secret on
 	// its own disk, outside the store, from the first push that carries one.
 	say("vault — the mesh's secrets get an owner, and their operator-sealed copies a place to live")