setup-benny

# Install automation pack ## Contract | Field | Bound contract | |---|---| | Trigger | User needs to install a third-party automation pack or template repository safely and deterministically | | Authority | Reversible local write (hash-guarded rollback). Explicit human invocation starts the install; preview every target and consequence before writing | | Side effect | Fetches the source archive to a scratch location, verifies all files against expected hashes, applies placeholder transformations, and atomically moves files to the target directory | | Done | The pack is installed in the target directory and passes safety checks | ## Inputs - Source archive URL (required): the URL to fetch the pack or template repository from. - Target directory (required): the local path where the pack will be installed. - Expected file manifest with hashes (required): a mapping of file paths to expected SHA-256 hashes, used to verify every extracted file. - Required file transformations (required): placeholder replacements keyed by strict unique anchors, applied to specified files after extraction. ## Procedure 1. Fetch the source archive to a scratch location. Download the archive from the source URL to a temporary directory. Done when: the archive is downloaded and extracted to the scratch location. 2. Verify all extracted files against the expected manifest and blob IDs. For every file in the extracted tree, compute its SHA-256 hash and compare against the expected manifest. Fail wit...