Add transactional uninstall for managed Telemt

[xPROMSx]

Adds --uninstall --confirm-uninstall and menu item 5 with an exact UNINSTALL confirmation. Only a deployment proven manager-owned by its schema-1 manifest, exact unit/Nginx/configuration/link contracts, safe exclusive roots and private account identity is removable. The manager and private backups remain installed. Telemt readiness/HTTP health is not required.

The exclusive-lock transaction durably saves static/control files, DATA anchors, root identities, Nginx context/plan, account UID/GID, certificate ownership and prior service state before stop. Mutable DATA descendants are not enumerated or hashed while Telemt runs; external account scans prune managed runtime roots. After stop/disable, inactive service, quiet UID/listener/firewall state are required before the complete authoritative objects-stopped snapshot and backup. Removal requires that stopped ledger and an exact recheck. Before file removal rollback leaves runtime untouched; after removal it restores the final stopped tree, Nginx, account and prior enabled/active state. Catchable signal exit codes are preserved.

Unknown safe ordinary files/directories beneath the validated DATA root are accepted generically. Static/control/index identity stays strict. Symlinks, hardlinks, FIFOs, sockets, devices, mounts, unsafe ownership/modes/xattrs and runtime outside the reviewed boundary require refusal/review. A deterministic child barrier reproduces active rewrite/create/atomic replacement/nested creation/deletion without sleep/retry and proves the final shutdown write is included in backup/rollback.

Certificates are preserved by default. Independent root-only schema-1 certificate.json retains non-secret lineage/renewal ownership; fresh same-domain Install validates and reuses it with no new ACME order. Legacy migration requires the existing manifest/current contracts. Explicit --delete-certificate uses installed Certbot's exact-lineage deletion interface only after core uninstall commits. Cleanup failure retains evidence and never reinstalls Telemt. Nginx reverse-plan and certificate helper functions retain their audited behavior.

Validation on exact HEAD 648f4251c179c9b1a12874b7c1c71260fc4db8d3: checks run 37022671989 / safety job 110889401573, all 24 steps successful, no skip/continue-on-error. Decoded logs prove 72 Python tests, all 29 previous native-root uninstall cases, two new churn success/stopped-rollback cases and 23 focused refusal cases (metadata/stop/quiescence/snapshot failures, nine static drifts, ten unsafe stopped-tree cases). Standalone/webroot preserve → same-domain Install reports ZERO new issuance and unchanged key/serial/renewal. Real local Certbot delete preserves foreign lineage/account; deletion failure does not resurrect Telemt. All existing suites pass, including 90 bootstrap signal cycles, real root account rollback, renewal, real Telemt CAP_NET_ADMIN/listener/HTTP/10-second dwell/clean firewall shutdown, real Nginx and 3x-ui topologies. The Actions synthetic merge tree equals the PR HEAD tree.

Local syntax, ShellCheck, Python compile/72 tests, Cloud-compatible suites and isolated real Telemt runtime pass. Native-root evidence comes from hosted Actions; root emulation cannot establish UID/GID/mount fidelity. Uninstall orchestration fixtures isolate NSS/services/listeners/firewall/issuance; filesystem safety is real and Certbot deletion uses private local self-signed lineages. They do not establish VPS systemd lifecycle, public ACME/renewal or Telegram acceptance. SIGKILL, power loss, disk failure and concurrent manual root edits remain manual-recovery boundaries.

SCRIPT_VERSION remains 0.1.2. Telemt 3.5.11 commit/digests, install.sh and the complete workflow are unchanged by this follow-up. Documentation retains Russian-primary README.md, full README.en.md and short README.ru.md navigation. No merge, release/tag or VPS access is part of this PR.