fix(install): clear "TMP: unbound variable" + non-zero exit on cleanup

The cleanup `trap 'rm -rf "$TMP"' EXIT` referenced a `local TMP` from
inside cmd_sync(). EXIT traps fire when the shell exits, not when the
function returns — by then the function-local was out of scope, and
set -u exploded the trap body with "TMP: unbound variable", which
masked the script's true exit status with 1.

The install/upgrade work itself completed before the trap ran (so it
looked cosmetic), but the non-zero exit broke automated wrappers and
cron jobs that check $?.

Two changes, both small:

  1. Drop `local` so TMP persists at script scope through the EXIT
     trap.
  2. Use `${TMP:-}` in the trap body so any future regression that
     tightens TMP's scope (or adds a code path where TMP is never
     assigned) doesn't re-introduce the same explosion.

Verified with `bash -c 'set -euo pipefail; foo() { local TMP;
TMP=$(mktemp -d); trap "rm -rf \$TMP" EXIT; }; foo'` → reproduces
the original error; the patched form is silent and exits 0.

install.sh

@@ -135,9 +135,15 @@ cmd_sync() {
   [ -n "$OWNER" ] || { err "Could not detect parent directory owner via stat"; exit 1; }
   info "Owner (from $WHMCS/modules/servers): $OWNER"
 
-  local TMP
+  # NOTE: TMP is intentionally NOT declared `local`. The EXIT trap fires when
+  # the shell exits, not when this function returns — by then a function-local
+  # would be out of scope and `set -u` would explode the trap body with
+  # "TMP: unbound variable", masking the script's real exit code with 1.
+  # The `${TMP:-}` expansion in the trap is belt-and-suspenders: harmless
+  # if TMP somehow ends up unset, and prevents future regressions if anyone
+  # moves the assignment back into a tighter scope.
   TMP=$(mktemp -d)
-  trap 'rm -rf "$TMP"' EXIT
+  trap 'rm -rf "${TMP:-}"' EXIT
 
   info "Downloading $VERSION..."
   curl -fsSL "https://github.com/$REPO/archive/refs/tags/$VERSION.tar.gz" -o "$TMP/src.tar.gz"