Fix four audit findings

- patch/apply.sh: replace sed with Python+env-var for PATCH_DIR
  substitution into sitecustomize.py; sed's & and | metacharacters
  silently corrupt or truncate the output for paths containing those
  chars; Python str.replace has no metacharacter issues; also write to
  a tmp file and mv atomically so a failed substitution never leaves
  an empty sitecustomize.py at the destination
- recover.sh: fix re-enable hint from $PATCH_DIR/apply.sh to
  $PATCH_DIR/patch/apply.sh (apply.sh moved into patch/ subdirectory)
- install.sh + uninstall.sh: match PREINIT hook on comment field
  ("TrueCloud provider patch (S3/B2)") instead of exact script path;
  exact-path match breaks when the repo is moved after install —
  uninstall leaves the stale hook registered (fires on every boot),
  and reinstall creates a duplicate entry; install.sh now also updates
  the script path on re-run so a moved repo self-corrects

patch/apply.sh

@@ -100,11 +100,21 @@ else
     if [ "$_can_install" = true ]; then
         # Substitute PATCH_DIR into the source so sitecustomize.py knows where
         # to write hook_status.json and check the kill switch at runtime.
-        if sed "s|/data/truecloud-patch|$PATCH_DIR|g" \
-               "$PATCH_DIR/patch/sitecustomize.py" \
-               > "$SITE_PKG/sitecustomize.py"; then
+        # Pass PATCH_DIR via env var so arbitrary path characters don't break
+        # the substitution (sed metacharacters & and | are unsafe in shell-
+        # interpolated replacement strings).  Write to a temp file first so a
+        # failed substitution never truncates the existing sitecustomize.py.
+        _sc_tmp="$SITE_PKG/sitecustomize.py.truecloud-tmp"
+        if TRUECLOUD_PATCH_DIR="$PATCH_DIR" \
+               "$PYTHON" -c "
+import os, sys
+d = os.environ['TRUECLOUD_PATCH_DIR']
+with open(d + '/patch/sitecustomize.py', encoding='utf-8') as fh:
+    sys.stdout.write(fh.read().replace('/data/truecloud-patch', d))
+" > "$_sc_tmp" && mv "$_sc_tmp" "$SITE_PKG/sitecustomize.py"; then
             echo "OK: Installed sitecustomize.py → $SITE_PKG/sitecustomize.py"
         else
+            rm -f "$_sc_tmp"
             echo "WARNING: Failed to write $SITE_PKG/sitecustomize.py (permission error?)"
         fi
     fi