fix(scripts): create cold-storage target before archiving models

[patil2001]

Summary

The Secure Boot auto-resume unit embedded ${SCRIPT_DIR} unquoted in ExecStart and WorkingDirectory, so an install path containing a space produced a unit systemd can't start right when it matters most — after MOK enrollment reboot. The unit also expanded ${USER} at generation time, which kills the whole install with "unbound variable" when invoked from a context that doesn't export USER (systemd/cron) — after mokutil --import queued but before the one-time password was shown. Paths are now quoted and USER falls back to id -un.

Behavior and invariants

Invariant	Implementation
Enrollment flow unchanged	Only unit-file quoting/lookup changed
Resume works on spaced paths	systemd receives a single quoted path token

AI Assistance

AI-assisted enumeration of generation-context failures. The author reproduced both failure shapes and is responsible for the final diff.

Release Lane

• Stable hotfix targeting release/2.6.x
• Mainline change targeting main
• Next-minor work targeting the next feature/minor release
• Not sure; reviewer should help classify

Stable hotfix reason:

Not targeting the stable release branch directly.

Changed Surface

• Docs only
• Tests only
• Dashboard UI
• Installer
• Core runtime
• Dashboard API
• CI workflows

Validation

• bash -n ods/installers/lib/detection.sh - passed.