fix(deploy): make portal installer runtime portable

www/integrations/nixos/deploy.md

@@ -61,7 +61,7 @@ npm run deploy:rollback -- FULL_APPROVED_SHA --confirm
 ## Employee resources: separate one-time operation
 
 Approved non-PHI employee files are never part of an ordinary release. After
-the website release that contains `portal-resource-install.mjs` is promoted and
+the website release that contains `portal-resource-install.sh` is promoted and
 the VPS SOPS-backed Basic Auth material is independently ready:
 
 ```sh
@@ -72,9 +72,11 @@ AIA_DEPLOY_SSH_IDENTITY="$HOME/.ssh/AIAMarketing" \
 npm run deploy:portal-resources -- --confirm
 ```
 
-The installer reads only the private collection manifest, accepts approved
-`STAFF-INTERNAL` and `MANAGEMENT-INTERNAL` mappings to `/staff-resources/` and
-`/management-resources/`, verifies every local hash, rejects links/traversal and
+The installer invokes the promoted root-only `portal-resource-install.sh` through
+NixOS's base `/bin/sh` and coreutils path; it does not depend on a globally
+installed Node.js runtime. It reads only the private collection manifest,
+accepts approved `STAFF-INTERNAL` and `MANAGEMENT-INTERNAL` mappings to
+`/staff-resources/` and `/management-resources/`, verifies every local hash, rejects links/traversal and
 uploads a root-controlled temporary tree. It never uses `--delete` for resource
 directories and refuses to replace a different existing file. The VPS installs
 regular files as `root:nginx` mode `0640` and reports metadata only.