CI checkouts have no .env, so the backup-and-restore pattern in the
installation and set-domain tests fatally failed on the first read. The
tests now seed .env from .env.example when absent, the way an installer
would, and remove it again afterwards. Developer machines are unaffected.
The cleanup step deletes any file the shipped manifest does not list outside
the protected prefixes. A SQLite database kept under database/ (a path the
installer accepts) is user state that can never appear in a manifest, so an
update destroyed it. The keep-list now always includes the resolved database
file of every in-installation SQLite connection, plus its -wal/-shm/-journal
side files. Found by the 3.0.0-alpha.2 -> alpha.3 upgrade rehearsal.
Darko Gjorgjijoski