fix(install.sh): run the smoke test from beside the install directory

The downloaded binary was run with --version from the mktemp work directory
under TMPDIR. On a host whose /tmp is mounted noexec, every execve there
fails with EACCES, so the script stopped with "the downloaded binary does
not run on this machine" for a release that runs from ~/.local/lib.

Stage the release next to the install directory first, as the final move
already did, and run the check from there. A binary that still does not run
is refused as before, naming the directory it was tried from, and the staged
copy is removed.

Refs #1623

install.sh

@@ -194,13 +194,18 @@ main() {
     tar --no-same-owner -xzf "$work/$asset" -C "$work/release"
     [ -f "$work/release/ai-memory" ] || die "$asset has no ai-memory binary"
     chmod 0755 "$work/release/ai-memory"
-    "$work/release/ai-memory" --version >/dev/null 2>&1 ||
-        die "the downloaded binary does not run on this machine"
 
     mkdir -p "$(dirname "$lib_dir")" "$bin_dir"
     staged="$lib_dir.new.$$"
     rm -rf "$staged"
     mv "$work/release" "$staged"
+    # Run the binary from beside its install directory, not from the work
+    # directory: a TMPDIR mounted noexec refuses to execute anything there,
+    # which would reject a release that runs where it is installed.
+    if ! "$staged/ai-memory" --version >/dev/null 2>&1; then
+        rm -rf "$staged"
+        die "the downloaded binary does not run from $(dirname "$lib_dir") on this machine"
+    fi
     if [ -e "$lib_dir" ]; then
         previous="$lib_dir.old.$$"
         mv "$lib_dir" "$previous"