fix(installer): harden greenfield detector contracts

.woodpecker/greenfield-install.yml

@@ -34,6 +34,25 @@ steps:
         bash tools/verify-greenfield-expected-red.sh \
           main-git-present /tmp/greenfield-main-git-present.log "$fixture_status"
 
+  greenfield-remote-installer-contract:
+    image: node:22-bookworm-slim
+    commands:
+      - |
+        expected="$(awk 'NF {print $1; exit}' tools/install.sh.sha256)"
+        actual="$(sha256sum tools/install.sh | awk '{print $1}')"
+        test "$actual" = "$expected"
+        set +e
+        MOSAIC_GREENFIELD_CONTAINER=1 \
+          MOSAIC_FIXTURE_INSTALLER_URL="https://git.mosaicstack.dev/mosaicstack/stack/raw/commit/${CI_COMMIT_SHA}/tools/install.sh" \
+          MOSAIC_FIXTURE_INSTALLER_SHA256="$expected" \
+          bash tools/e2e-install-test.sh --lane next --source remote --git present \
+          > /tmp/greenfield-remote.log 2>&1
+        fixture_status=$?
+        set -e
+        cat /tmp/greenfield-remote.log
+        bash tools/verify-greenfield-expected-red.sh \
+          next-git-present /tmp/greenfield-remote.log "$fixture_status"
+
   greenfield-git-absent:
     image: node:22-bookworm-slim
     commands: