install.sh: stage live image and auto-restart on upgrade

Single-command upgrades were leaving /var/lib/vetting/live/ stale on
PXE-enabled LXCs because install.sh explicitly punted live-image
staging to pxe-setup.sh. That was right when make-release ran on a
dev box, but the new registry-pull flow ships vmlinuz+initrd.img
inside the bundle — they should land in place during every install.

install.sh now:
  - auto-detects live-image/{vmlinuz,initrd.img} (release bundle
    layout) or ../live-image/build/ (repo dev checkout) and stages
    them into --live-dir (default /var/lib/vetting/live).
  - restarts vetting.service when already enabled, so the
    curl | sudo bash one-liner is the full upgrade loop. First-
    install path still leaves the service stopped for config edits.

pxe-setup.sh's own live-image copy is now redundant on upgrade but
still runs for first-time PXE setup (it also writes the pxe: block
of vetting.yaml, which install.sh has no business touching).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/operations.md

@@ -220,9 +220,13 @@ Rerun the registry-fetch one-liner on the LXC:
 ```
 curl -fsSL https://gitea.thewrightserver.net/josh/Vetting/raw/branch/main/deploy/proxmox-install.sh \
     | sudo bash
-sudo systemctl restart vetting
 ```
 
+That's it — `install.sh` auto-restarts `vetting.service` when it's
+already enabled, and re-stages `vmlinuz`/`initrd.img` into
+`/var/lib/vetting/live/` so PXE-enabled LXCs come back up with the
+fresh live image. Watch the logs with `journalctl -fu vetting`.
+
 Pin to a specific build with `VETTING_VERSION=sha-abc1234` if you
 need to roll back or test a commit. The DB migration runs at startup
 and is append-only — no manual schema work unless a release's notes