Keep installation checks readable and require a loaded unit

Visual review found the bounded systemctl example clipped its option lines on a phone. Give each property its own line and distinguish a missing unit from a loaded root service before interpreting its settings.

Contract-Neutral: Documentation and focused verification only; no installer, runtime, API, persistence or security contract delta.
Change-source: pulse-maintainer

docs/INSTALL.md

@@ -211,13 +211,21 @@ values or credentials:
 
 ```bash
 systemctl show pulse.service \
-  --property=User --property=Group --property=NoNewPrivileges \
-  --property=PrivateTmp --property=ProtectSystem --property=ProtectHome
+  --property=LoadState \
+  --property=User \
+  --property=Group \
+  --property=NoNewPrivileges \
+  --property=PrivateTmp \
+  --property=ProtectSystem \
+  --property=ProtectHome
 ```
 
 Use your actual server unit name if it differs; older installations may use
-`pulse-backend.service`. An empty `User=` means systemd runs the service as
-root. Missing hardening is not repaired just by downloading a new binary:
+`pulse-backend.service`. Interpret these settings only when
+`LoadState=loaded`; `LoadState=not-found` means the selected unit is missing,
+not that a root service is running. For a loaded service, an empty `User=`
+means systemd runs it as root. Missing hardening is not repaired just by
+downloading a new binary:
 **the installer preserves existing service units during updates**, including
 custom units.