Installer: guard against silently adopting existing data (reuse / wipe / new dir)

[LukasWodka]

Implements the installer leftover-guard from RFC-0003 (tracebloc/cli#366, D3 — §4). Related: #367 (node-local storage), design: tracebloc/backend#1151.

Problem

The installer creates its data directories with mkdir -p and adopts whatever already exists there — data left by an earlier install (different layout, older version, custom dir) is silently picked up by the next install, so a "fresh" install isn't guaranteed fresh.

Goal

If the data directories are non-empty at install time, stop and make the user choose — never adopt silently. This also doubles as the migration prompt for the node-local transition (#367): existing data is never silently stranded.

Subtasks

• Detect existing data across both on-disk layouts (flat + per-release)
• Interactive prompt: reuse / wipe / choose a new directory
• Non-interactive mode: explicit flags (e.g. --reuse-data / --wipe-data / --data-dir), fail-safe default = abort with a clear message
• bats tests for all paths
• Docs: install/upgrade behavior note

Acceptance

An install onto a machine with leftover data never proceeds silently; each choice path is tested.