install.sh: verify Composer installer checksum and merge daemon.json

Address PR review feedback:
- Verify the downloaded Composer installer against the official
  installer.sig sha384 signature before executing it, to guard against a
  tampered or MITM'd download in automated setup.
- Merge only the storage-driver key into /etc/docker/daemon.json instead
  of overwriting the whole file, preserving any pre-existing daemon
  configuration and keeping the step idempotent.

Co-authored-by: Nicolas Ruflin <ruflin@users.noreply.github.com>

Author: cursoragent

.cursor/install.sh

@@ -36,7 +36,16 @@ $APT_INSTALL \
 
 echo "==> Installing Composer"
 if ! command -v composer >/dev/null 2>&1; then
+    # Verify the installer against the official signature before running it
+    # (guards against a tampered/MITM'd download).
     php -r "copy('https://getcomposer.org/installer', '/tmp/composer-setup.php');"
+    expected_checksum="$(php -r "copy('https://composer.github.io/installer.sig', 'php://stdout');")"
+    actual_checksum="$(php -r "echo hash_file('sha384', '/tmp/composer-setup.php');")"
+    if [ "$expected_checksum" != "$actual_checksum" ]; then
+        echo "ERROR: invalid Composer installer checksum" >&2
+        rm -f /tmp/composer-setup.php
+        exit 1
+    fi
     php /tmp/composer-setup.php --quiet --install-dir=/tmp --filename=composer.phar
     sudo mv /tmp/composer.phar /usr/local/bin/composer
     rm -f /tmp/composer-setup.php
@@ -56,10 +65,13 @@ sudo usermod -aG docker "$(id -un)" || true
 
 echo "==> Configuring Docker daemon for the nested-container VM (fuse-overlayfs)"
 # The default overlayfs/overlay2 driver cannot mount inside this VM; fuse-overlayfs
-# is the supported nested-container storage driver.
+# is the supported nested-container storage driver. Merge just the storage-driver
+# key so any pre-existing daemon config (registry mirrors, log options, ...) is
+# preserved; only restart the daemon when the driver actually changes.
 sudo mkdir -p /etc/docker
-if [ ! -f /etc/docker/daemon.json ] || ! grep -q fuse-overlayfs /etc/docker/daemon.json; then
-    echo '{ "storage-driver": "fuse-overlayfs" }' | sudo tee /etc/docker/daemon.json >/dev/null
+current_driver="$(sudo php -r '$f="/etc/docker/daemon.json"; $c=is_file($f)&&""!==trim((string) @file_get_contents($f))?json_decode((string) file_get_contents($f), true):[]; echo \is_array($c)&&isset($c["storage-driver"])?$c["storage-driver"]:"";' 2>/dev/null || true)"
+if [ "$current_driver" != "fuse-overlayfs" ]; then
+    sudo php -r '$f="/etc/docker/daemon.json"; $c=is_file($f)&&""!==trim((string) @file_get_contents($f))?json_decode((string) file_get_contents($f), true):[]; if(!\is_array($c)){$c=[];} $c["storage-driver"]="fuse-overlayfs"; file_put_contents($f, json_encode($c, \JSON_PRETTY_PRINT|\JSON_UNESCAPED_SLASHES)."\n");'
     sudo service docker restart || sudo service docker start || true
 fi
 sudo service docker start || true