PASS: spaces-install-secret writes on match, exits 1 on cancel, 2 on mismatch, kills the dialog on SIGTERM, refuses a concurrent call