Validate module --auto-install on a physical rooted device (MagiskSU two-parse model + cleanup)

Start with PR #37 and its mocked, argv-exact tests to understand the expected push, MagiskSU install, checksum, reporting, and cleanup behavior. Run beetroot module <name> <zip> --auto-install on a physical rooted Android device with Magisk, then work through the checklist for normal, spaced, hostile, mismatched, batched, and failed installs. Done means the checklist passes and any divergence is folded back into the mocked tests.

Summary

PR #37 (#7) shipped beetroot module <name> <zip> --auto-install for adb-adopted rooted devices with the full CI-level contract pinned by mocked, argv-exact tests (push → su -c 'magisk --install-module …' → cleanup rm, sha256 fail-closed, per-module reporting, hostile-filename injection tests). What it could not include — the development environment has no Android device or Docker daemon — is a run against a real MagiskSU.

This issue tracks that one-time smoke validation on a physical rooted phone (or any real adb target with Magisk) before the feature is treated as release-grade.

Why this is worth a real-device pass

The security fix in PR #37 rests on a specific model of two device-side shell parses: adb shell flattens argv into one line (parse 1: device shell), then MagiskSU re-joins everything after -c and executes it via an inner sh -c (parse 2). The fix (synthesized beetroot-module-<i>.zip temp names + dual-level shlex.quote) was hand-traced and review-approved against that model, but the model itself is exactly the kind of thing that varies across su implementations/versions — and mocked tests structurally cannot catch a wrong model, only a wrong implementation of it.

Checklist

• Happy path: a real module zip installs via --auto-install; module visible in magisk --list after reboot.
• Spaced local filename (My Module.zip) installs (synthesized remote name sidesteps both parses).
• Hostile local filename (e.g. $(true).zip — benign payload) installs normally, nothing executed, name never reaches a device shell.
• sha256 mismatch refused before any push.
• One bad zip in a multi-module batch: failed row + remaining modules still install; exit 1.
• Cleanup: no beetroot-module-*.zip left in /data/local/tmp after success AND after an install failure.
• Fold any divergence found back into the mocked tests (adjust the model, then the strings the tests pin).

Refs

• #7, PR #37 (the "physical-device smoke test … still worthwhile before release" note in its body, and the security re-review's hand trace).
• Related but distinct: #29 (LSPosed recipe) — same hardware session could cover both.