fix(api): guard /v1/install catch against non-JSON Error.message (PKT-530 / PKT-472 regression)

[bugsyhewitt]

Summary

• Re-applies the PKT-472 Part B 12-line wrap that was silently reverted by commit 37be0689 (PKT-476, Aug 1 23:51 EDT)
• Wraps JSON.parse((e as Error).message) at server.ts:238 in a try/catch; on parse failure returns 400 INSTALL_HANDLER_ERROR with a stable structured body instead of letting a SyntaxError escape to the outer 500 catch
• Adds a regression test (installState.installThrow = true path in ts-api-server-route-handler-defensive-paths.test.ts) to lock the fix against future reversion

Defect class

shipped-then-reverted-via-subsequent-commit (same class as prior regressions in the decisions-log). PKT-472 Part B was correctly fixed and PR-diff'd in PR #405, but PKT-476 (37be0689) touched the surrounding region and restored the unwrapped line. This is the disciplinary gap PKT-530 closes: the regression test now pins the boundary.

Test plan

• TDD red confirmed: before fix, new test fails with expected 500 to be 400 + SyntaxError: Unexpected token 'm' logged (exact regression from packet §3)
• TDD green confirmed: after fix, pnpm exec vitest run → 138 files passed | 2 skipped (140 total), 2162 tests passed | 46 skipped
• PYTHONPATH=src pytest → 1206 passed, 125 skipped, 6 warnings
• Runtime verify: server started on scratch port 18530 with unreachable DB; POST /v1/install with valid credentials returns 400 {"error":{"code":"INSTALL_HANDLER_ERROR","message":"Install handler failed; see server logs for details.","details":{}}} — not 500
• Binding review (alienclaw-architect, opus): APPROVED — spec, correctness, test placement, scope, 3-layer, walls, naming all PASS

Files changed

• src/alienclaw/api/server.ts — +12 lines (inner try/catch wrap around JSON.parse)
• test/api/ts-api-server-route-handler-defensive-paths.test.ts — +10 lines (regression test, inserted before the stats-override block)

🤖 Generated with Claude Code