fix(peer): harden streamed install lifecycle

Claude Fable 5's branch review found that receiver cancellation or a QUIC
send failure could leave the sender-side archive producer blocked on the
bounded frame channel. That kept the outbound transfer guard alive and could
block later installs or updates of the same game.

Route archive frames through a cancellable StreamInstallFrameSink instead of
exposing the raw channel sender to providers. The QUIC forwarder now cancels
and closes the receive side before awaiting the producer, so a blocked send
wakes and the transfer guard can drop normally.

Make PeerCommand::StreamInstallGame own its peer metadata preflight inside the
peer core. The Tauri layer now sends the command directly, and the peer runtime
fetches file details from catalog-version peers before running the existing
majority validation and retry logic. This removes the UI-only pending streamed
install set and gives PeerEvent::GotGameFiles one meaning again: continue a
normal archive download.

Tighten the receiver transaction edge cases too. Rollback removes a newly
created empty game root, but preserves pre-existing roots. Once streamed
staging has been promoted to local/, intent or launch-settings cleanup failures
are logged for startup recovery instead of reporting a failed install for bytes
that are already committed.

Accept missing RAR CRC32 metadata for zero-byte files as CRC32 00000000 while
still requiring CRC32 metadata for non-empty files. Update the peer README,
scenario docs, and next-steps handoff so the documented ownership and remaining
trust limitation match the implementation.

Test Plan:
- just fmt
- just test
- just frontend-test
- just clippy
- git diff --check
- python3 -m py_compile \
  crates/lanspread-peer-cli/scripts/run_extended_scenarios.py
- python3 crates/lanspread-peer-cli/scripts/run_extended_scenarios.py \
  S39 S40 S41 S42 S43 S44 S45 S46 S47 --build-image

Refs: streamed-install review handoff from Claude Fable 5

crates/lanspread-peer/README.md

@@ -14,8 +14,8 @@ It is designed to run headless – other crates (most notably
   roots are announced or served.
 - `PeerCommand` represents the small control surface exposed to the UI layer:
   `ListGames`, `GetGame`, `FetchLatestFromPeers`, `DownloadGameFiles`,
-  `InstallGame`, `UninstallGame`, `RemoveDownloadedGame`, `CancelDownload`,
-  `SetGameDir`, and `GetPeerCount`.
+  `StreamInstallGame`, `InstallGame`, `UninstallGame`, `RemoveDownloadedGame`,
+  `CancelDownload`, `SetGameDir`, and `GetPeerCount`.
 - `PeerEvent` enumerates everything the peer runtime reports back to the UI:
   library snapshots, download/install/uninstall lifecycle updates, runtime
   failures, and peer membership changes.
@@ -28,8 +28,8 @@ lifetime of the process:
 
 1. **Server component** (`run_server_component`) – listens for QUIC connections,
    advertises via mDNS, and serves `Request::ListGames`, `Request::GetGame`,
-   `Request::GetGameFileData`, and `Request::GetGameFileChunk` by reading from
-   the local game directory.
+   `Request::GetGameFileData`, `Request::GetGameFileChunk`, and
+   `Request::StreamInstall` by reading from the local game directory.
 2. **Discovery loop** (`run_peer_discovery`) – uses the `lanspread-mdns`
    helper to discover other peers. The blocking mDNS work is executed on a
    dedicated thread via `tokio::task::spawn_blocking` so that the Tokio runtime
@@ -87,6 +87,26 @@ When the UI asks to download a game:
 7. After a successful sentinel commit, `PeerEvent::DownloadGameFilesFinished`
    is emitted and the peer auto-runs the install transaction.
 
+### Streamed Install Pipeline
+
+Low-disk installs use `PeerCommand::StreamInstallGame` instead of the normal
+archive download pipeline. The peer core owns the whole operation: it refreshes
+file metadata from catalog-version peers, runs the same majority file-size
+validation used by normal downloads, selects a validated peer list, and emits
+the regular download/install lifecycle events while streaming archive-expanded
+bytes directly into a `StreamedInstallTransaction`.
+
+The sender-side `StreamInstallProvider` writes control and chunk frames through
+a cancellable `StreamInstallFrameSink`. If the QUIC writer fails because the
+receiver cancelled or disconnected, the sink wakes any producer blocked on the
+bounded frame channel and lets the transfer guard drop normally.
+
+Each failed peer attempt rolls back its staging directory before trying the next
+validated peer. A transaction that created a previously missing game root
+removes that root again when rollback leaves it empty. Once staging has been
+renamed to `local/`, post-promote intent or launch-settings cleanup failures are
+logged for startup recovery rather than reported as a failed install.
+
 `PeerCommand::CancelDownload` cancels the tracked download token for an active
 transfer. The transfer task remains responsible for clearing `active_operations`,
 discarding partial payload files, and refreshing the settled local snapshot, so