fix(install): escape sed replacements, use mktemp, and make render failures fatal

Address CodeRabbit findings on install_service.sh, install_web_service.sh and
install_wifi_monitor.sh:

- Values interpolated into each script's sed expression (project root path,
  username) were not escaped, so a value containing &, \ or the | delimiter
  would corrupt the rendered systemd unit. Add a shared
  sed_escape_replacement() helper in the new scripts/install/lib_systemd_render.sh
  (sourced by all three scripts) and apply it to every sed replacement.
- install_service.sh rendered the main and web units to the predictable path
  /tmp/ledmatrix.service.tmp before installing them -- a symlink/TOCTOU race
  (CWE-377). Use mktemp for both, with a trap to clean up on exit.
- install_service.sh treated a missing template as a mere warning and then
  checked only whether a unit already existed at the destination before
  enabling/starting it, so a render failure could silently fall back to
  enabling a stale, previously-installed unit. Both unit blocks now exit
  non-zero on a missing template or a failed render.

Also rename the ambiguous loop variable `l` to `line` in
test/test_systemd_unit_drift.py (Ruff E741); ruff isn't wired into any CI
workflow in this repo today, so this isn't currently CI-blocking, but the
rename is trivial and correct regardless.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3bPMESe2TfrGvbs1ef9c5

test/test_systemd_unit_drift.py

@@ -204,7 +204,7 @@ def test_the_web_unit_still_reports_a_real_changed_directive(validator, tmp_path
 
     rendered = _render(template.read_text(encoding="utf-8"), project_root, "hdpi")
     # Drop RestartSec -- one of the directives the stale heredoc was missing.
-    stale = "\n".join(l for l in rendered.splitlines() if not l.startswith("RestartSec="))
+    stale = "\n".join(line for line in rendered.splitlines() if not line.startswith("RestartSec="))
     installed = tmp_path / "ledmatrix-web.service"
     installed.write_text(stale + "\n", encoding="utf-8")