refactor(provision-kit): move install-source configuration to its owner

[thymikee]

Parent: #2129

Blocked by: none. Wave 1; this is provisioning-source configuration, not generic CLI parsing.

Scope — exact tracked files

Production:

• src/utils/install-source-config.ts

There is no dedicated tracked utility test for this module. Existing CLI/config/install coverage is outside src/utils and remains in place.

Destination and importer edits

Move the parser to:

• packages/provision-kit/src/install-source-config.ts

Expose it through the existing provision-kit export map as the named subpath @agent-device/provision-kit/install-source-config; do not create a generic config package or root shim.

Update exactly these production importers:

• src/cli-schema/cli-config.ts
• src/commands/management/install.ts

Add focused coverage beside the moved package module at:

• packages/provision-kit/src/install-source-config.test.ts

The test may be extracted from the existing CLI/config/install cases but must assert the parser independently rather than comparing the implementation to itself.

Behavior invariants

Preserve the owner/repo:artifact grammar, whitespace/empty-input handling, GitHub 操作 artifact field names, exact DaemonInstallSource shape, and typed INVALID_ARGS messages and causes. Preserve CLI config precedence and install-from-source request projection. This child must not change archive materialization, download trust, host-path refusal, transport, or app installation behavior.

Focused validation

Run:

• pnpm vitest run packages/provision-kit/src/install-source-config.test.ts src/__tests__/cli-config.test.ts src/commands/management/output.test.ts (use the current install/config test paths for any missing file)
• the provision-kit package boundary/layering tests
• pnpm check:affected --run

Planted-red proof

No new structural rule is added. Plant an invalid owner/repo:artifact fixture and observe the parser test fail with the named INVALID_ARGS contract before restoring the valid implementation. The export-map check must also fail if the source imports through an unexported package path; keep that check green without adding a compatibility export.

Dependency order

Wave 1. This child is independent of the snapshot, host, transport, command, and surface children. The terminal child is blocked by it.

Shrink target

Delete src/utils/install-source-config.ts with no duplicate implementation. The package addition is a move plus its focused test; after discounting that move, production LOC must not grow and no src/utils path may remain in the install/config import graph.