[mikelangmayr]

• Host setup was 235 lines of shell per instrument, drifting from the Python that checks it. <name> install does it instead, from the same Product the rest of the CLI reads.
• The unit, polkit rule, sudoers drop-in and the two helper scripts become templates rendered per instrument. Verified against hispec: all four come out byte-identical to what is installed on hispecserver today, directive for directive.
• doctor now compares the installed unit and polkit rule against what install would write, rather than against a committed copy that will no longer exist. That is also the check that catches a host whose unit predates a template change.
• Adds display_name, so systemctl status keeps reading HISPEC hardware daemon rather than hispec.
• Building the venv stays outside: this code lives in it. The instrument's install.sh keeps the uv bootstrap and hands over.
• Exercised against a fake root: creates the directories, seeds secrets.env and the host file, writes all five artefacts, validates the sudoers file with visudo before installing it, and reports unchanged for everything on a second run.