fix: assert the install landed the ref we asked for — a silent wrong-install is worse than a failure

The 0.5.0 env-var rename (CLAUDEBOX_* -> BOX_*) created a silent trap:
a STALE local drill.sh passes CLAUDEBOX_REPO/REF, today's install.sh
reads BOX_REPO/REF, the vars are ignored, main gets installed — and the
drill runs to a green summary having drilled the wrong tree entirely.
The same class already cost an hour once via a lagged CDN tarball.

install.sh now records what it installed (/INSTALLED_FROM), and the
drill ASSERTS it matches the requested repo@ref before touching the
host — failing loudly, and naming the stale-checkout cause, instead of
drilling a lie.

drill/drill.sh

@@ -175,6 +175,23 @@ EOF
     || { echo "install failed"; exit 1; }
   export PATH="$HOME/.local/bin:$PATH"
 
+  # ASSERT WHAT LANDED — never trust that the install obeyed us.
+  # This has bitten twice: once on a lagged CDN tarball, once when a STALE local
+  # drill.sh passed the retired CLAUDEBOX_* env vars to a 0.5.0 install.sh that
+  # reads BOX_* — the vars were ignored, main was installed, and the run drilled
+  # the wrong tree while reporting success. A drill that silently drills the
+  # wrong code is worse than one that fails.
+  got="$(cat "$HOME/.local/share/box/INSTALLED_FROM" 2>/dev/null || echo '<unknown>')"
+  if [ "$got" != "$REPO@$REF" ]; then
+    echo "drill: FATAL — asked to install $REPO@$REF, but the tree says '$got'." >&2
+    echo "  Your local drill.sh is probably STALE (pre-0.5.0 it passed CLAUDEBOX_*," >&2
+    echo "  which today's install.sh ignores, so it fell back to main). Fix:" >&2
+    echo "    git fetch origin && git checkout <the branch you mean> && git pull" >&2
+    echo "  then re-run this drill." >&2
+    exit 1
+  fi
+  inf "installed tree confirms: $got"
+
   phase "Host setup (Incus, boxnet, ACL, profile, firewall)"
   # setup-host.sh installs nftables itself when neither nft nor UFW exists
   # (a stock Debian 13 cloud image ships neither). This guard is a tripwire:

install.sh

@@ -85,4 +85,10 @@ if ! command -v incus >/dev/null 2>&1; then
   warn "  run the one-time host setup: $DEST/host/setup-host.sh"
 fi
 
-log "done — try: box new --name test"
+# Record WHAT was installed, so a caller can assert it got what it asked for.
+# Without this, an installer invoked with stale env vars (the CLAUDEBOX_* names
+# retired in 0.5.0) silently falls back to the defaults and installs main —
+# and the caller drills the wrong tree, believing it drilled its branch.
+printf '%s@%s\n' "$REPO" "$REF" > "$DEST/INSTALLED_FROM"
+
+log "done ($REPO@$REF) — try: box new --name test"