Installer takes the tunnel binary from /tmp/containariumd: decide the source policy #3681

Question (owner decision needed)

`scripts/install-lab-tunnel.sh` (`BINARY_SRC`, default `/tmp/containariumd`) and `scripts/lib/deploy-install.sh` (default `/tmp/containariumd`) install a root-owned binary from a predictable path in `/tmp`. A local user who creates that file first gets it installed as root. The operator is expected to `scp` the binary there, so the path is part of the workflow.

Options:

• A. Keep the default, refuse a symlink source. Smallest change; does not stop a user-owned file at the path.
• B. Refuse any source not owned by root or the invoking operator, and print the path that was used. Blocks the planted-file case; the operator's own upload still works.
• C. Require an explicit `BINARY_SRC` with no default. Strongest; changes the documented workflow.

Default if no answer: B.

Acceptance criteria (after the decision)

• The chosen policy is applied in both scripts, the same way.
• Test: a planted symlink, and a file owned by an unrelated user, are each refused; the operator's own file is accepted.

Follow-up to #3342.

Blocked by: none
Sprint: #3725
Part of #3725