Let install.sh smoke harness opt past Docker-environment refusal

install.sh refuses to run inside Docker (correct behavior for end
users), but the install-sh-smoke gate runs the documented systemd
install path inside a privileged systemd-in-Docker container — the
one legitimate bypass case. Added PULSE_INSTALL_ALLOW_DOCKER=1
escape hatch in check_docker_environment() and set it on the docker
exec in the smoke workflow. Takes effect on the next RC; v6.0.0-rc.6's
published install.sh predates this and is signed-frozen, so its
post-publish smoke gate will remain red until the next prerelease.

.github/workflows/install-sh-smoke.yml

@@ -229,8 +229,12 @@ jobs:
           echo "Running install.sh --archive against the published tarball..."
           # docker exec without -t leaves stdin without a TTY, which install.sh's
           # safe_read helper detects and falls through to defaults on every prompt.
-          docker exec "${container_name}" \
-            bash -lc "cd /smoke && bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
+          # PULSE_INSTALL_ALLOW_DOCKER=1 opts the smoke harness past install.sh's
+          # Docker-environment refusal — install.sh treats the test container as
+          # a normal systemd host, which is the exact contract this gate exists
+          # to validate.
+          docker exec -e PULSE_INSTALL_ALLOW_DOCKER=1 "${container_name}" \
+            bash -lc "cd /smoke && PULSE_INSTALL_ALLOW_DOCKER=1 bash install.sh --archive /smoke/${tarball} --disable-auto-updates"
 
           echo "Waiting for pulse.service to become active..."
           for i in $(seq 1 60); do

install.sh

@@ -780,6 +780,13 @@ check_docker_environment() {
        grep -q docker /proc/self/cgroup 2>/dev/null || \
        [[ -f /run/.containerenv ]] || \
        [[ "${container:-}" == "docker" ]]; then
+        # The install.sh smoke gate exercises the documented systemd install
+        # path inside a privileged systemd-in-Docker test container. That is
+        # the one legitimate case for bypassing this guard.
+        if [[ "${PULSE_INSTALL_ALLOW_DOCKER:-}" == "1" ]]; then
+            print_warn "Docker environment detected but PULSE_INSTALL_ALLOW_DOCKER=1 set; continuing."
+            return 0
+        fi
         print_error "Docker environment detected"
         echo "Please use the Docker image directly: docker run -d -p 7655:7655 $(repo_docker_image_ref latest)"
         echo "See: $(repo_docker_docs_url)"