Fix Rocq/Opam installation for non-root user context

The opam install script was receiving "y" as installation path instead
of accepting the default. Fix by providing the correct path
($HOME/.local/bin) as first input. Also add fallback direct binary
download and ensure .opam directory always exists for COPY --from.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: konard

ubuntu/24.04/rocq/install.sh

@@ -25,8 +25,21 @@ log_step "Installing Rocq/Coq via Opam"
 if ! command_exists opam; then
   log_info "Installing Opam (OCaml package manager)..."
 
-  bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh) --no-backup" <<< "y" || {
-    maybe_sudo apt install -y opam || true
+  # Install opam binary to user-writable location
+  OPAM_BIN_DIR="$HOME/.local/bin"
+  mkdir -p "$OPAM_BIN_DIR"
+  export PATH="$OPAM_BIN_DIR:$PATH"
+  # The install script asks: 1) path [/usr/local/bin], 2) create dir? [Y/n]
+  printf '%s\n%s\n' "$OPAM_BIN_DIR" "Y" | bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh) --no-backup" || {
+    # Fallback: download opam binary directly
+    ARCH="$(uname -m)"
+    case "$ARCH" in
+      x86_64)  OPAM_ARCH="x86_64" ;;
+      aarch64) OPAM_ARCH="arm64" ;;
+      *)       OPAM_ARCH="$ARCH" ;;
+    esac
+    curl -fsSL "https://github.com/ocaml/opam/releases/latest/download/opam-2.3.0-${OPAM_ARCH}-linux" -o "$OPAM_BIN_DIR/opam" && \
+      chmod +x "$OPAM_BIN_DIR/opam" || true
   }
 
   if command_exists opam; then
@@ -82,4 +95,10 @@ if command_exists opam; then
   fi
 fi
 
+# Ensure .opam directory exists (required for COPY --from in full-sandbox)
+if [ ! -d "$HOME/.opam" ]; then
+  log_warning "Opam directory not found - creating minimal structure"
+  mkdir -p "$HOME/.opam"
+fi
+
 log_success "Rocq/Coq installation complete"